Telephonic communications – Call or terminal access alarm or control – Fraud or improper use mitigating or indication
Reexamination Certificate
1998-03-10
2002-04-23
Matar, Ahmad F. (Department: 2742)
Telephonic communications
Call or terminal access alarm or control
Fraud or improper use mitigating or indication
C379S114030
Reexamination Certificate
active
06377672
ABSTRACT:
BACKGROUND OF THE INVENTION
1. Field of the Invention
The present invention relates a telecommunications network and more particularly to a method of, and a system for, detecting the possible fraudulent use of a telecommunications network.
2. Background of Related Art
Rule-based fraud detection systems attempt to detect fraudulent usage by comparing details of individual calls over the telecommunications network with a series of one or more predefined rules. If a particular usage of the network (to be referred to throughout this specification as a “call record”) triggers one or more of the predefined rules, an alarm is generated, enabling human operators to take the necessary action. While such systems have had some success in combating fraud, difficulties tend to arise due to the sheer number of alarms that wan be generated within a short time. Typically, fraud detection operators may have tens of thousands of live alarms to deal with during a day, and it is therefore generally impractical to deal with each individual alarm as it arises. Methods have been developed for consolidating or grouping the fraud alarms based on their priority, but the workload for the fraud operators still remains substantial.
Work has been done to provide correlated fault alarms for identifying possible faulty network devices and/or failure of communication links in telecommunication networks. However, the correlation process here relies very much upon the fact that the network topology is well known, with the alarms and the alarms correlations being calculated on that basis.
BRIEF SUMMARY OF THE INVENTION
It is an object of the present invention at least to alleviate these problems. It is a further object to provide a method of, and a system for, detecting the possible fraudulent use of a telecommunications network which can be used across a range of products and services.
According to a first aspect of the present invention there is provided a method of detecting the possible fraudulent use of a telecommunications network, the method comprising:
(a) receiving alarms indicative of potentially fraudulent calls on the network, the alarms being divided into a plurality of alarm types;
(b) associating a unique customer identifier with each alarm;
(c) selecting a test class of customer identifiers such that each customer identifier in the test class is associated with a given grouping of alarm types;
(d) identifying those customer identifiers within the test class that are associated with known fraudulent calls and deriving a measure therefrom indicative of fraud within the test class; and
(e) determining that any customer identifier associated with further alarms is connected with fraudulent use of the network if it falls within the test class and if the measure for that class exceeds a given level.
According to a second aspect of the invention there is provided a system for detecting the possible fraudulent use of a telecommunications network, the system comprising:
(a) means for receiving alarms indicative of potentially fraudulent calls on the network, the alarms being divided into a plurality of alarm types;
(b) means for associating a unique customer identifier with each alarm;
(c) means for selecting a test class of customer identifiers such that each customer identifier in the test class is associated with a given grouping of alarm types;
(d) means for identifying those customer identifiers within the test class that are associated with known fraudulent calls and deriving a measure therefrom indicative of fraud within the test class; and
(e) means for determining that any customer identifier associated with further alarms is connected with fraudulent use of the network if it falls within the test class and if the measure for that class exceeds a given level.
By iterating the method, the system gradually learns and becomes more effective at identifying fraud.
The present invention discovers patterns in the alarm data, and operates on those, rather than operating on the rules that generate the alarms themselves. Preferably, the system attempts to detect fraudulent usage by measuring and comparing the parameters values of individual calls, over the telecommunications network, against pre-set thresholds within the detection rules. This allows for a reduced number of derived alarms to be created, thereby easing the task of the fraud operators. In contrast with known network fault alarm correlations, the invention is not limited to use on any specific network or on any specific model. Instead, it identifies fraud trends by identifying patterns in particular groupings of raw alarms. The solution is applicable across all products and services.
In one form, the invention may provide the fraud operators with a display identifying, in order, those groups of alarms which are most indicative of the presence of fraud and, against each group, a list of (normalized) customer identifiers whose calls have triggered alarms in that particular group. A numerical measure may be associated with each grouping, providing the fraud operators with a quantitative estimate of the probability that a particular customer identifier is associated with fraudulent calls.
The system may automatically determine that certain alarm groupings are associated with fraud (for example if the measure exceeds a predefined value), and may automatically inhibit the user accounts corresponding to the user identifiers which fall within those groupings. Alternatively, the information may be provided to human operators, who may reserve to themselves the final decisions.
It is not essential, of course, that the measure takes the form of a single numerical value. It could, instead, consist of several numerical or non-numerical indicators that may be tested against a predefined level. Again, the given level in that case need not itself be a single numerical value. It will be understood, of course, that if the measure increases with fraud, then it will exceed the given level in the upward-going direction when the measure is larger than the level. On the other hand, if the measure is designed to fall with increasing fraud, then it will exceed the given level in the downward-going direction when it falls to a value below that of the given level.
In its various forms, the invention, or preferred aspects of it, may provide a very concise easily-understood presentation of alarm information to the fraud operator. It provides improved use of alarm data, along with the flexibility to add new alarm types and continuously to detect and learn new alarm types. It allows easier detection of fraud by the human operator, or alternatively may be arranged to detect fraud automatically. This may provide substantial revenue savings from the increased ability of the fraud detection systems, as a whole, to detect fraud at an early stage and to apply preventative measures.
REFERENCES:
patent: 4182934 (1980-01-01), Keys et al.
patent: 5420910 (1995-05-01), Rudokas et al.
patent: 5602906 (1997-02-01), Phelps
patent: 0583135 (1994-02-01), None
patent: 0618713 (1994-10-01), None
patent: 0653868 (1995-05-01), None
patent: 0661863 (1995-07-01), None
patent: WO 94/11959 (1994-05-01), None
Agdeppa Hector
British Telecommunications public limited company
Matar Ahmad F.
Nixon & Vanderhye P.C.
LandOfFree
Fraud monitoring in a telecommunications network does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Fraud monitoring in a telecommunications network, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Fraud monitoring in a telecommunications network will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-2835497