Big data analytics for telecom fraud detection

Techniques of detecting telecom fraud involve applying a combination of real-time data analysis and risk models typically used in authentication applications to phone call metadata that is streamed to a database server on a continual basis to derive phone usage patterns as the database server receives the phone usage data. The database server then compares the derived phone usage patterns to patterns of fraudulent phone usage in order to detect SIM box or SIM cloning fraud in the streamed data. A comparison result that indicates the likelihood of such fraud in a vast set of phone calls may take the form of a risk score derived using risk models typically found in authentication applications.

BACKGROUND

Malicious subscribers of telecom services may attempt to commit telecom fraud in order to avoid legitimate charges or to make money from other, unsuspecting subscribers. Such telecom fraud may cost telecom service providers significant revenue and reduce the quality of the service provided to subscribers.

One type of telecom fraud is known as subscriber identity module (SIM) box fraud, a result of which is the theft of revenue that telecom service providers derive from international calls. In this case, a malicious subscriber intercepts calls in one country destined for another country into one end of a voice over IP (VoIP) network that bypasses a gateway through which telecom companies meter international calls. The malicious subscriber then has a SIM box connected to the other end of the VoIP network that poses as a cell phone on a telecom network in the other country to route the calls to their destination.

Another type of telecom fraud is known as SIM cloning, and involves the theft of identifying information of a SIM card belonging to a legitimate subscriber in order to fraudulently provide calls on a telecom network at the expense of the legitimate subscriber. A SIM card is a small memory module that contains, among other pieces of information, a unique serial number (ICCID) identifying that SIM card and an international mobile subscriber identity (ISMI) identifying a subscriber. These details are then input in new SIM cards to form SIM clones. A call made from a phone using a cloned SIM card may then be billed to the legitimate subscriber.

Conventional approaches to detecting telecom fraud involve manually analyzing individual subscriber accounts in order to establish fraudulent use of telecom services. For example, a subscriber who notices fraudulent charges on a bill may notify a telecom service provider of the charges. In response, an investigator with the telecom service provider examines calls associated with the charges to determine the type of fraud being perpetrated against the subscriber. The investigator may then study a larger pool of calls made using the telecom services to determine a source of that fraud.

SUMMARY

Unfortunately, there are deficiencies in the above-described conventional approaches. For example, telecom networks stream a huge amount of data (˜4 TB of signaling data per hour). Manual analysis of individual calls through such a volume of data is unlikely to identify perpetrators of fraud within a reasonable amount of time.

In contrast with the above-described conventional approach, which is reactive and slow to detect fraud, improved techniques of detecting telecom fraud involve applying a combination of real-time data analysis and risk models typically used in authentication applications to phone call metadata that is streamed to a database server on a continual basis to derive phone usage patterns as the database server receives the phone usage data. The database server compares the derived phone usage patterns to patterns of fraudulent phone usage in order to detect SIM box or SIM cloning fraud in the streamed data. A comparison result that indicates the likelihood of such fraud in a vast set of phone calls may take the form of a risk score derived using risk models typically found in authentication applications.

Advantageously, the improved techniques are proactive and can detect telecom fraud as phone call metadata is streamed to the database server. By detecting fraudulent activity quickly within a vast amount of streaming data, losses due to such activity may be minimized or even prevented. Such real-time fraud detection is made possible through a combination of big-data analytical tools and authentication risk models that indicate a likelihood that a vast set of phone calls contain patterns of SIM box or SIM cloning fraud.

One embodiment of the improved techniques is directed to a method of detecting fraud in a telecommunications network. The method includes receiving, by a phone call database server, phone call metadata, the phone call metadata describing phone calls completed through phones over the telecommunications network. The method also includes performing, by the phone call database server, a data analytics operation on the received phone call metadata as the phone call metadata is received, the data analytics operation producing, as a result, patterns of phone calls completed through the phones. The method further includes comparing the patterns of phone calls made by the phones to specified patterns of fraudulent phone use to produce a comparison result, the comparison result indicating a likelihood that phone calls completed through at least one of the phones are fraudulent.

Additionally, some embodiments are directed to a phone call database server apparatus constructed and arranged to detect fraud in a telecommunications network. The apparatus includes a network interface, memory and controlling circuitry coupled to the memory. The controlling circuitry is constructed and arranged to carry out a method of detecting fraud in a telecommunications network.

Further, some embodiments are directed to a computer program product having a non-transitory, computer-readable storage medium which stores executable code, which when executed by a controlling circuitry, causes the controlling circuitry to detecting fraud in a telecommunications network.

DETAILED DESCRIPTION

Improved techniques of detecting telecom fraud involve applying a combination of real-time data analysis tools and risk models typically used in authentication applications to phone call metadata that is streamed to a database server on a continual basis to derive phone usage patterns as the database server receives the phone usage data. Advantageously, the improved techniques are proactive and can detect telecom fraud as phone call metadata is streamed to the database server.

FIG. 1shows an example electronic environment100in which embodiments of the improved techniques hereof can be practiced. The electronic environment100provides a coupling between a telecommunications network120, which provides cell phone service, and a phone call database server110that determines whether fraudulent phone calls are being conducted within the telecommunications network120. The electronic environment100includes a base station104and a mobile switching center server130each connected to the telecommunications network120. The electronic environment100also includes a communications medium140that connects the mobile switching center server130to the phone call database server110.

The base station104is one of several base stations configured to handle traffic and signaling between various cell phones102and the mobile switching center server130over the telecommunications network120. Although base station104is depicted inFIG. 1as an antenna that receives phone call data from phones102and transmits the phone call data to the mobile switching center server130, base station104typically includes other equipment for encrypting and decrypting such communications, allocating radio frequencies to the communications, and other functions. It should be understood that typical, modern infrastructure for providing cell phone service contains other components not depicted inFIG. 1but also not critical for the discussion of the improved techniques herein.

Cell phones102may be any type of phone authorized to use bandwidth provided by the telecommunications network120to conduct phone calls. The cell phones102present credentials for authorization in the form of identifiers stored in a SIM card106. The SIM card106contains a pair of identifiers108: an international mobile subscriber identity (IMSI) and a mobile subscriber ISDN (MSISDN), i.e., a phone number. The IMSI/MSISDN pair108is transmitted with other signals used to request cell phone services over the telecommunications network120.

The telecommunications network120provides radio communications between various base stations, e.g., base station104, and various mobile switching centers containing mobile switching center servers, e.g., mobile switching center server130. The telecommunications network120is assumed to conform to the Global System for Mobile Communications (GSM) standard in the example under discussion.

The mobile switching center server130contains a home location register (HLR)132. The HLR132is a central database that contains details of each mobile phone subscriber that is authorized to use the telecommunications network120, as well as services requested by that subscriber. For example, the HLR132stores complete details of every SIM card issued by a service provider. Further, the HLR132stores the current position of a subscriber according to the particular mobile switching center through which the subscriber last attempted to request a connection to the telecommunications network120. Thus, the HLR132may provide a rich set of metadata associated with each phone call.

The communications medium140provides network connections between mobile switching center server130and the phone call database server130. The communications medium140may implement any of a variety of protocols and topologies that are in common use for communications over the internet. Further, the communications medium140may include various components (e.g., cables, switches/routers, gateways/bridges, etc.) that are used in such communications.

It should be understood that the communications medium140is illustrated inFIG. 1as standing apart from the telecommunications network120. However, in alternative arrangements, the communications medium140may be co-located with the telecommunications network120.

The phone call database server110is a computer system that receives and stores continuously streaming phone call data, including phone call metadata136from the HLR132, to carry out the improved techniques. The phone call database server110includes a network interface112, processing units114, a memory116, and non-volatile storage160. The network interface112includes, for example, adapters, such as SCSI target adapters and network interface adapters, for converting electronic and/or optical signals received from the communications medium140to electronic form for use by the phone call database server110. The processing units114include one or more processing chips and/or assemblies. In a particular example, the processing units114include multi-core CPUs. The memory116includes both volatile memory (e.g., RAM), and non-volatile memory, such as one or more ROMs, disk drives, solid state drives, and the like. The processing units114and the memory116together form control circuitry, which is constructed and arranged to carry out various functions as described herein.

The memory116is also constructed and arranged to store various data, for example, metadata from stream136such as IMSI/MSISDN108and expressions of data patterns in data pattern repository122. The memory116is further constructed and arranged to store a variety of software constructs realized in the form of executable instructions, such as real-time analytics engine118and risk engine124. When the executable instructions are run by the processing units114, the processing units114are caused to carry out the operations of the software constructs. Although certain software constructs are specifically shown and described, it should be understood that the memory116typically includes many other software constructs, which are not shown, such as an operating system, various applications, processes, and daemons, for example.

The real-time analytics engine118is configured to locate metadata in stream136, as well as stored in storage160, that satisfy data patterns stored in data pattern repository122. It should be understood that, because data received by the phone call database server110, including the metadata steam136, may exceed 4 TB per hour (representing over 80,000 signaling events per second), the real-time analytics engine expresses algorithms that may quickly perform the sort of searching and sorting over such a lake of data in a short time. An example of such a data analytics engine is encapsulated in the Real Time Intelligence for Telecommunications (RTI4T) by Pivotal, a subsidiary of EMC Corp. of Hopkinton, Mass.

The risk engine124is configured to output a risk score from the values of any number of risk factors taken as input. In the discussion here, the risk engine124is adapted to take as factors values of metadata, or combinations of those values, that may or may not fit patterns of fraud stored in pattern repository122. The risk engine124may also take as factors a behavioral history associated with a particular ISMI108.

The storage160is provided, for example, in the form of hard disk drives and/or electronic flash drives. In some arrangements, the storage is organized in RAID groups, where each RAID group is composed of multiple disk drives. The storage160is constructed and arranged to store a database162for arranging metadata from stream136, such as Greenplum provided by EMC Corp. of Hopkinton, Mass.

During an example operation, the phone call database server110receives a stream136of metadata over the communications medium140from the HLR132. While it is assumed that the phone call database server110receives the stream136on a continuous basis, other arrangements are possible. It should be understood that the phone call metadata in the stream136contains data that describes phone calls. Such metadata includes the IMSI, the phone number (MSISDN), a location from where the phone calls were made, i.e., a switching center that received a call request, a begin and end time for each phone call, an indication of whether each call was incoming or outgoing, and the like.

At some point in time, e.g., upon receipt of a request to determine if fraud is being committed within the telecommunications network120, the phone call database server110performs a data analytics operation on the stream of data136. For example, an investigator with a telecommunications service provider might send a request to analyze incoming metadata for signs of SIM box fraud.

In response, the real-time analytics engine118performs a data analytics operation on the stream136of metadata and the database162as the phone call database server110is receiving the stream136. For example, instructions contained in real-time analytics engine118cause the processing units114to execute a search for metadata in the database132that satisfies fraud patterns encapsulated in patterns stored in patterns repository122. One example of such patterns includes suspicious ratios of outgoing calls to incoming calls associated with a single ISMI108.

Once the real-time analytics engine produces data that fit specified fraud patterns, risk engine124considered these fraud patterns in light of historical phone call metadata stored in database162. For example, the risk engine124takes as input values of risk factors including typical call times, phone numbers to which calls were made, and so on. Based on these values, the risk engine124outputs a risk score that indicates the likelihood that fraud is occurring within the telecommunications network120.

FIG. 2illustrates the real-time fraud detection framework described above, but pertaining to SIM box fraud specifically. InFIG. 2, a SIM box210is shown receiving call traffic220that had been fraudulently routed around an international gateway. It should be understood that the SIM box210poses as a cell phone for the HLR132. Thus, the SIM box210is associated with an IMSI and a phone number (MSISDN). For example, the SIM box then “initiates” a phone call to the phone102aby routing the traffic220to the mobile switching center server130via base station104a. In this case, the mobile switching center server130may reroute the call to the phone102avia base station104bby looking up the location of the IMSI associated with the phone102ain the HLR132.

It has been determined that patterns of data indicating SIM box fraud may be derived from factors including location of SIM box210during each phone call and whether each phone call is incoming or outgoing. For example, the SIM box210may make a large volume of outgoing local calls without changing its location significantly. It should be understood that other factors derived from metadata may also be importance to detecting SIM box fraud, and the example shown inFIG. 2is for illustrative purposes.

To effect the detection of SIM box fraud as depicted inFIG. 2, the phone call database server110reads SIM box patterns from repository122as being expressed as a function of two factors associated with a phone call: (i) a termination indicator value (i.e., whether the call was outgoing or incoming) and (ii) a distance moved since the previous phone call.

The phone call database server110then searches through the metadata stream136and the database162for calls associated with a particular ISMI associated with the SIM box210. For each phone call associated with the particular ISMI that was found by the phone call database server110, the phone call database server computes (i) a ratio of outgoing calls to incoming calls and (ii) a net movement across all the found phone calls. It should be understood that the values used to compute these quantities are found in the metadata streamed from the HLR132.

The phone call database server110then compares these values (i) and (ii) with values that have been found to indicate evidence of SIM box fraud. For example, a ratio of 10 outgoing calls to 1 incoming calls, or greater, may be one indication of SIM box fraud (e.g., because the SIM box is configured to receive a large amount of call traffic over a VoIP network). Further, zero net movement over many dozens of calls may also indicate SIM box fraud because the SIM box210is typically stationary, being connected to a VoIP network.

Further, in some arrangements, rather than concluding evidence of fraud based on the values of either or both of these two factors, the risk engine124takes in the values of the termination indicator and location for each found phone call associated with the particular ISMI. The risk engine may also take in other factors, such as historical behavior associated with the ISMI outside of this phone call metadata, such as when the ISMI established the MDISDN associated with the SIM box210. Based on the input values of these factors, the risk engine outputs a risk score that indicates the likelihood that the subscriber associated the ISMI is operating a SIM box illegitimately. For a high enough risk score (e.g., higher than some threshold), the service provider may take remedial action against the subscriber.

FIG. 3illustrates the real-time fraud detection framework described above, but pertaining to SIM cloning fraud. In this scenario, a malicious actor steals information such as the IMSI108from the SIM card106aof a subscriber authorized to conduct phone calls on the telecommunications network120. Using this information, the malicious actor creates clones of the SIM card106a, e.g., clone106b. The malicious actor then may sell phones, e.g., phone102bthat use the cloned SIM card106b. In this case, the “subscriber,” unwittingly or not, may make phone calls over the telecommunications network120using the IMSI of the legitimate subscriber associated with the phone102a. The legitimate subscriber is then stuck with the charges associated with calls made with phone102b.

It has been determined that patterns of data indicating SIM cloning fraud may be derived from factors including the start and end times of each phone call associated with an ISMI108as well as the location of calls associated with the ISMI. For example, because the respective users of phones102aand102bwill generally be unaware of each other and not necessarily near each other, calls that are close together—and certainly calls that are made simultaneously—may be suspect. (Some telecommunications networks may not allow simultaneous calls. In that case, times at which a call was attempted during another call may be of interest.) It should be understood that other factors derived from metadata may also be importance to detecting SIM cloning fraud, and the example shown inFIG. 3is for illustrative purposes.

To effect the detection of SIM cloning fraud as depicted inFIG. 3, the phone call database server110reads SIM cloning patterns from repository122expressed as a function of three factors of a phone call associated with an ISMI: (i) start time of the call, (ii) end time of the call, and (iii) a location of the call.

The phone call database server110then searches through the metadata stream136and the database132and the database162for calls associated with the ISMI108. For each phone call associated with the particular ISMI that was found by the phone call database server110, the phone call database server computes (i) a call overlap time indicating how often calls completed through the particular phone and the second phone were being conducted close in time together and (ii) a peak user velocity indicating a maximum distance between the particular phone and the second phone as the particular phone and the second phone are conducting phone calls close together. It should be understood that the values used to compute these quantities are found in the metadata streamed from the HLR132.

The phone call database server132then compares these values (i) and (ii) with values that have been found to indicate evidence of SIM cloning fraud. For example, calls that were made 30 seconds apart (e.g., the end time of a first call is 30 second before the begin time of a second call) from locations over a mile apart may be one indication of SIM cloning fraud (e.g., because the peak velocity one person would need to attain to cross that mile).

Further, in some arrangements, rather than concluding evidence of fraud based on the values of any of the three factors, the risk engine124takes in the values of the start time, end time, and location for each found phone call associated with the particular ISMI. The risk engine may also take in other factors, such as historical behavior associated with the ISMI outside of this phone call metadata, such as when the ISMI established the MDISDN associated with each phone102aand102b. Based on the input values of these factors, the risk engine outputs a risk score that indicates the likelihood that a subscriber's SIM card was cloned. For a high enough risk score (e.g., higher than some threshold), the service provider may take remedial action against the subscriber.

FIG. 4illustrates a method400of detecting fraud in a telecommunications network according to the improved techniques and provides a summary of some of the material presented above. The method400may be performed by the software constructs described in connection withFIGS. 1-3, which reside in the memory116of the phone call database server110and are run by the set of processing units114.

At410, phone call metadata is received by a phone call database server. The phone call metadata describes phone calls completed through phones over a telecommunications network. The metadata may include factors such as ISMI, call location, call start and end times, and termination indicator associated with each call, for example.

At420, the phone call database server performs a data analytics operation on the received phone call metadata as the phone call metadata is received. The data analytics operation produces, as a result, patterns of phone calls completed through the phones. In some examples, such patterns may be encapsulated in combinations of values of the above-described factors, e.g., a ratio of outgoing to incoming phone calls.

At430, the patterns of phone calls made by the phones are compared to specified patterns of fraudulent phone use to produce a comparison result. The comparison result indicates a likelihood that phone calls completed through at least one of the phones are fraudulent. In a simple example, the ratio of outgoing to incoming phone calls for a given ISMI being greater than 10 may indicate SIM box fraud. Moreover, such a ratio, or even the factors, may be input into a risk engine that computes a risk score indicating the likelihood of SIN box fraud.

Improved techniques of detecting telecom fraud involve applying a combination of real-time data analysis tools and risk models typically used in authentication applications to phone call metadata that is streamed to a database server on a continual basis to derive phone usage patterns as the database server receives the phone usage data. Advantageously, the improved techniques are proactive and can detect telecom fraud as phone call metadata is streamed to the database server.

Having described certain embodiments, numerous alternate embodiments or variations can be made. For example, the above examples pertained to a GSM telecommunications network. Other arrangements may pertain to networks that follow the CDMA standard.

Further, although features are shown and described with reference to particular embodiments hereof, such features may be included and hereby are included in any of the disclosed embodiments and their variants. Thus, it is understood that features disclosed in connection with any embodiment are included as variants of any other embodiment.

Further still, the improvement or portions thereof may be embodied as a non-transient computer-readable storage medium, such as a magnetic disk, magnetic tape, compact disk, DVD, optical disk, flash memory, Application Specific Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA), and the like (shown by way of example as medium440inFIG. 4). Multiple computer-readable media may be used. The medium (or media) may be encoded with instructions which, when executed on one or more computers or other processors, perform methods that implement the various processes described herein. Such medium (or media) may be considered an article of manufacture or a machine, and may be transportable from one machine to another.

As used throughout this document, the words “comprising,” “including,” and “having” are intended to set forth certain items, steps, elements, or aspects of something in an open-ended fashion. Also, as used herein and unless a specific statement is made to the contrary, the word “set” means one or more of something. This is the case regardless of whether the phrase “set of” is followed by a singular or plural object and regardless of whether it is conjugated with a singular or plural verb. Although certain embodiments are disclosed herein, it is understood that these are provided by way of example only and the invention is not limited to these particular embodiments.