Method and system for preventing illicit use of a telephony platform

• US 9,948,788 B2
• Filed: 02/23/2017
• Issued: 04/17/2018
• Est. Priority Date: 07/24/2012
• Status: Active Grant

• Current Assignee: Twilio, Inc.
• Original Assignee: Twilio, Inc.
• Inventors: Ballai, Adam, Hagemann, III, Robert C., Zarick, Daniel
• Primary Examiner(s): CAI, WAYNE HUU
• Application Number:
  US15/440,908
• Publication Number:
  US 20170163817A1
• Time in Patent Office: 418 Days
• Field of Search: 455410, 455411, 455405, 455406, 705 1426, 705 1447, 705 2635, 379189, 37912702
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 7/0078 Security; Fraud detection; Fraud prevention
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

A system and method for preventing illicit use of a telephony platform that includes enrolling a plurality of accounts on a telecommunications platform, wherein an account includes account configuration; at a fraud detection system of the telecommunications platform, receiving account usage data, wherein the usage data includes at least communication configuration data and billing configuration data of account configuration and further includes communication history of the plurality of accounts; calculating fraud scores of a set of fraud rules from the usage data, wherein at least a sub-set of the fraud rules include conditions of usage data patterns between at least two accounts; detecting when the fraud scores of an account satisfy a fraud threshold; and initiating an action response when a fraud score satisfies the fraud threshold.

Claims

1. A method comprising:

a multi-tenant telecommunication platform system performing a machine learning process to automatically generate a telephony fraud rule set that includes a plurality of telephony fraud rules,

wherein the machine learning process generates the telephony fraud rule set from stored telephony fraud scenario data for at least one telephony fraud scenario that has occurred, and

wherein each generated telephony fraud rule includes a usage pattern that, when matching at least a portion of the telephony fraud scenario data, sets a telephony fraud score that indicates occurrence of a telephony fraud scenario that corresponds to the portion of the telephony fraud scenario data;

the platform system storing the telephony fraud rule set;

the platform system receiving a request to create a first parent account from an external first application developer system via one of an API of the platform system and a user interface of the platform system;

the platform system creating the first parent account for the first application developer system;

the platform system receiving a request to create a first sub-account of the first parent account from the first application developer system via the API;

the platform system creating the first sub-account account for the first parent account;

the platform system receiving a request to create a second sub-account of the first parent account from the first application developer system via the API;

the platform system creating the second sub-account account for the first parent account;

the platform system receiving a first usage request from the first application developer system via the API, wherein the first usage request is a request of the first sub-account;

the platform system generating first usage data responsive to processing the first usage request, wherein the first usage data corresponds to illicit use of the platform system by the first sub-account;

the platform system determining each telephony fraud rule of the telephony fraud rule set that matches at least the first usage data;

for each matching telephony fraud rule, the platform system assigning the telephony fraud score associated with the telephony fraud rule to the first sub-account;

the platform system determining a sum of all telephony fraud scores assigned to the first sub-account;

the platform system determining whether the sum is above a first telephony fraud score threshold; and

responsive to a determination that sum is above the first telephony fraud score threshold, the platform system performing a first fraud action.

2. The method of claim 1, wherein the first fraud action is one of automatic termination of the first sub-account, throttling of communication of the first sub-account, and blocking at least one action the first sub-account.

3. The method of claim 1, wherein the first fraud action includes the platform system providing a notification of illicit use of the first sub-account to the first application developer system via the API.

4. The method of claim 1, wherein the platform system automatically generates at least one telephony fraud rule based on observed data including data provided by at least one of:

a communication history data source, a billing information data source, an assigned endpoint data source, and an application configuration data source.

5. The method of claim 4, wherein the platform system automatically generates each telephony fraud rule by using one of a Bayesian learning process, a neural network, and a reinforcement learning process.

6. The method of claim 1, wherein the first application developer system is a call center system.

7. The method of claim 1, wherein the first application developer system is a conference call service system.

8. The method of claim 1, wherein the first application developer system is a personal voicemail system.

9. The method of claim 1, wherein the first application developer system is a notification service system.

10. The method of claim 1, wherein the first application developer system is a two-factor authentication service system.

11. The method of claim 1, wherein the first usage data includes at least:

usage data associated with call history data, and wherein the telephony fraud scenario data includes data provided by a communication history data source.

12. The method of claim 1, wherein the first usage data includes at least:

usage data associated with messaging history data, and wherein the telephony fraud scenario data includes data provided by a communication history data source.

13. The method of claim 1, wherein the first usage data includes at least:

usage data associated with platform account configuration data, and wherein the telephony fraud scenario data includes data provided by an application configuration data source.

14. The method of claim 1, wherein the first usage data includes at least:

usage data associated with credit card data, and wherein the telephony fraud scenario data includes data provided by a billing information data source.

15. The method of claim 1, wherein the machine learning process is one of a Bayesian learning process, a neural network process, and a reinforcement learning process.

16. The method of claim 15, wherein the platform system stores the telephony fraud scenario data.

17. The method of claim 16, wherein the platform system generates the telephony fraud scenario data.

18. The method of claim 17, wherein the platform system generates the telephony fraud scenario data during processing of at least one usage request that is received via the API.

19. The method of claim 18, wherein the first usage data includes at least:

usage data associated with call history data, and wherein the telephony fraud scenario data includes data provided by an assigned endpoint data source.

20. The method of claim 18, wherein the first usage data includes at least:

usage data associated with messaging history data, and wherein the telephony fraud scenario data includes data provided by an assigned endpoint data source.