Telecommunications – Radiotelephone system – Security or fraud prevention
Reexamination Certificate
1999-11-18
2003-03-18
Le, Thanh Cong (Department: 2684)
Telecommunications
Radiotelephone system
Security or fraud prevention
C455S411000, C379S145000, C379S189000
Reexamination Certificate
active
06535728
ABSTRACT:
BACKGROUND OF THE INVENTION
1. Field of the Invention
This application relates to the field of telecommunications and more particularly to the field of fraud detection in telecommunications systems.
2. Description of Related Art
Along with the growth in wireless telecommunications, there has been a growth in telecommunications fraud. The current techniques for committing fraud are generally known and understood. Fraud may be as simple as the physical theft of a wireless handset, or applying for a wireless subscription with no intention of paying. Other fraud is more sophisticated. For example, tumbling-clone fraud entails the interception of a number of valid identification numbers from airborne wireless traffic, and the use of each identifier in sequence to render detection of the fraudulent activity more difficult. Also, some of the fraudulent activity focuses on fraudulently obtaining subscriptions. For example, a thief might falsify application information or steal valid personal information from another individual.
However, understanding the modalities for wireless fraud does not provide any specific strategy for addressing the fraud. A wireless carrier may have millions of subscribers, who may collectively make millions of calls each day. Even if some of the characteristics of fraudulent activity are known, it may be impractical to allocate human resources to examine each call individually. If a typical wireless telecommunications system handles two million calls each day, perhaps only a few hundred of these calls should be examined closely. One approach to “filtering” this mass of information is disclosed in U.S. Pat. No. 5,615,408, which describes a system for credit-based management of telecommunications activity. According to the '408 patent, each call within the system is examined for possible credit problems among subscribers, and a credit alert is generated when a credit risk is present.
While the system disclosed in the '408 patent presents a significant advance in telecommunications monitoring, it may fail to detect certain fraudulent activity. For example, an identical identification number may occur simultaneously in two disjoint cells, which may not present any credit issues, but does indicate that a handset has been cloned. Additionally, the information available for a call may only suggest a heightened probability of fraud rather than a definite instance of fraud. As the search criteria for a fraud detection system broaden, more and more calls must be examined. Furthermore, automated responses, such as immediate termination of service, may be undesirable, particularly for legitimate subscribers that cross a statistical line into ostensibly fraudulent activity.
There remains a need for a telecommunications fraud detection system that can handle large call volume while permitting individualized attention to possibly fraudulent activity. The system should prioritize possibly fraudulent activity so that a human analyst can be assigned to investigate instances with a high likelihood of fraud.
SUMMARY OF THE INVENTION
According to the principles of the invention, a fraud detection system receives data relating to telecommunications activity. Event generators generate events from the received data, with each event having a weight corresponding to an increased or decreased likelihood of fraud. The aggregated events for a subject (a subscriber or an account) determine a score for the subject, which is used to prioritize the subject in an investigation queue. Human analysts are assigned to open investigations on the investigation queue according to the priority of subjects. In this manner, investigation resources can be applied more effectively to high-risk subscribers and events.
In one embodiment, a method for detecting fraud in a telecommunications system according to the principles of the invention includes: receiving one or more events relating to a subscriber; combining the one or more events to provide a score; and storing the subscriber and the score in an investigation queue if the score exceeds a predetermined threshold.
In this aspect, the method may further include repeating the above for a plurality of subscribers; and storing a plurality of suspect subscribers in the investigation queue, each one of the plurality of suspect subscribers having a score that exceeds the predetermined threshold. The method may further include prioritizing the investigation queue according to the plurality of scores. The method may include updating the score of one of the plurality of suspect subscribers to provide an updated score, and removing the one of the plurality of suspect subscribers from the investigation queue if the updated score does not exceed the predetermined threshold. The method may also include assigning a human analyst to investigate one of the plurality of suspect subscribers. The method may include determining a region for each one of the plurality of suspect subscribers; and assigning a regional human analyst to investigate those ones of the plurality of suspect subscribers having a particular region. In this method assigning a human analyst may further include: receiving a request to investigate from the human analyst; assigning to the human analyst a one of the plurality of suspect subscribers having a highest priority; and removing the one of the plurality of suspect subscribers from the investigation queue.
In the method, combining the one or more events to provide a score may further include: weighting the one or more events according to one or more event weights, thereby providing one or more weighted events; and summing the one or more weighted events to provide a score. This method may further include aging each of the one or more weighted events using a half-life. The one or more event weights may be discounted according to a match quality. The one or more event weights may be determined using logistic regression. Combining the one or more events to provide a score may further include feeding the one or more events to a neural network, the neural network being trained to generate a score indicative of possible fraud from the one or more events. This method may further include prioritizing the investigation queue according to the plurality of scores.
In another aspect, a system for detecting telecommunications fraud according to the principles of the invention includes: means for receiving one or more events relating to a subscriber; means for combining the one or more events to provide a score; and means for storing the subscriber and the score in an investigation queue if the score exceeds a predetermined threshold.
In this aspect, the system may further include: means for applying the receiving means, the combining means, and the storing means to a plurality of subscribers; and means for storing a plurality of suspect subscribers in the investigation queue, each one of the plurality of suspect subscribers having a score that exceed the predetermined threshold. The system may further include means for prioritizing the investigation queue according to the plurality of scores. The system may further include means for removing one of the plurality of suspect subscribers from the investigation queue if the one of the plurality of suspect subscribers has not been investigated within a predetermined time. The system may further include means for assigning a human analyst to investigate one of the plurality of suspect subscribers.
A system according to the principles of the invention may further include: means for determining a region for each one of the plurality of suspect subscribers; and means for assigning a regional human analyst to investigate those ones of the plurality of suspect subscribers having a particular region. The assigning means may include: means for receiving a request to investigate from the human analyst; and means for assigning to the human analyst a one of the plurality of suspect subscribers having a highest priority. The combining means may further include: means for weighting the one or more events according to
Antell Richard H.
Arena Michael J.
Buchanan Darin L.
Butler Timothy W.
Farrar Michael B.
Cong Le Thanh
Foley & Hoag LLP
Harry Andrew T
Lightbridge, Inc.
LandOfFree
Event manager for use in fraud detection does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Event manager for use in fraud detection, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Event manager for use in fraud detection will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3002578