Source: http://www.google.com/patents/US7142651?dq=6263352
Timestamp: 2016-07-29 14:18:30
Document Index: 790527783

Matched Legal Cases: ['art 210', 'art 210', 'arts 210', 'art 230', 'art 210', 'art 230']

Patent US7142651 - Fraud detection in a distributed telecommunications networks - Google PatentsSearch Images Maps Play YouTube News Gmail Drive More »Sign inPatentsMethods, apparatuses and systems for detecting a fraud event on a distributed network are disclosed. A fraud event is indicated if data analysis reveals that there is a lack of consistency between elements in the network....http://www.google.com/patents/US7142651?utm_source=gb-gplus-sharePatent US7142651 - Fraud detection in a distributed telecommunications networksAdvanced Patent SearchPublication numberUS7142651 B2Publication typeGrantApplication numberUS 09/995,792Publication dateNov 28, 2006Filing dateNov 29, 2001Priority dateNov 29, 2001Fee statusPaidAlso published asUS20030101357Publication number09995792, 995792, US 7142651 B2, US 7142651B2, US-B2-7142651, US7142651 B2, US7142651B2InventorsDavid Ronen, Daniel AdlerOriginal AssigneeEctel Ltd.Export CitationBiBTeX, EndNote, RefManPatent Citations (13), Referenced by (27), Classifications (14), Legal Events (6) External Links: USPTO, USPTO Assignment, EspacenetFraud detection in a distributed telecommunications networks
US 7142651 B2Abstract
Distributed networks are sometimes represented using the Open System Interconnection “OSI” model which includes seven layers as shown in FIG. 1. A layer generally includes a group of related functions performed in a given level in a hierarchy of groups of related functions. (Refer to www.webopedia.com; the model according to webopedia is summarized below).
Physical layer (layer 1) 114 conveys the bit stream—electrical impulse, light or radio signal—through network 200 at the electrical and mechanical level. Layer 114 provides the hardware means of sending and receiving data on a carrier, including defining cables, cards, and physical aspects.
The access function is provided by access function elements 214 located in an access part 210 (including one or more access networks). Clients 205 (phone, computer users, etc) connect to network 200 using any of a variety of technologies (for example digital subscriber line “DSL”, cable modems, wireless, local multipoint distribution system (LMDS), etc). Access part 210 also provide basic logical definitions in order to initiate the access connection.
It should be mentioned, that one element may be capable of performing functions belonging to more than one different functional groups. For example, such an element may be an integrated “border element” positioned between different network parts. Examples of such elements are access gateways or routers, which are usually capable of creating different records for different functions.
The meaning of the terms “correspondence” or “non-correspondence” with respect to the identifier fields and the value fields depends on details of each particular algorithm incorporated in the fraud detection rules. One identifier field is usually considered to correspond to another identifier field if they both express one and the same type of the identifier fields and one the same identifier, for example both relate to IP addresses and point to one and the same unique IP address. In a cellular network performing an access function, each IMSI number (International Mobile SIM Identifier) has one-to-one correspondence with a particular phone number, so such identifier fields should be considered identical.
Further, the apparatus may comprise a pre-processor unit for preparing the records data collected from said interface unit for said analyzer unit. The pre-processing unit may be capable, for example, of recognizing the corresponding data for the respective functional groups from the collected records data, and/or of forming statistically processed information based on the obtained records data. The analyzer unit preferably comprises fraud detection rules installed therein, and in any case—a comparing means for comparing the obtained, or pre-processed records data.
a computer readable program code for causing the computer to analyze records data related to at least one telecommunications session and originating from one or more elements belonging to at least two functional groups to determine whether there is a lack of consistency between the records data parts respectively associated to said at least two functional groups, a computer readable program code for causing the computer, if the lack of consistency is determined, to conclude that there is a fraud event. BRIEF DESCRIPTION OF THE DRAWINGS
FIG. 5 is a diagram of a Voice over IP (“VoIP”) network, according to a preferred embodiment of the present invention;
FIG. 8 is a diagram of a Digital Subscriber Line (“DSL”) network, according to a preferred embodiment of the present invention;
Fraud can be defined as the intentional perversion of truth in order to induce another to part with something of value. In networks, the “something of value” can be, for example, compensation for enabling usage of the network. Fraud therefore includes schemes which cause financial loss. Examples of fraud include schemes to avoid partial or full payment for network use, and denial of service, service abuse, and/or harmful network usage which lead to loss of revenues and/or customers.
Network 300 is in communication with a fraud detection apparatus 400. Although, fraud detection apparatus 400 could in some contexts also be considered an “element” of network 200, hereinbelow, the term “element” specifically excludes fraud apparatus 400 in order to more simply explain the invention.
In most cases, the network elements 301 from which the data is received and compared belong to at least two functional groups 314, 316, 318, 320, and 322, and/or belong to at least two parts 210, 230, and 240 of network 300. However in certain cases, the data is received from at least two different elements 301 in the same functional group and the same part of network 300. For example, data from a media gateway and a switch (both transport elements in transport part 230) can be received and compared. In this case, data from both elements 301 concern the same traffic. In other cases, all elements are “identical” elements, i.e. the same elements in the same functional group and in the same network part (and if all the identical elements are in access part 210 then all are also functioning for the same access technology), for example two routers in transport part 230.
The next example (FIG. 10) illustrates an aspect of the present invention where the comparison of data is performed on statistics related to a series of records. FIG. 10 illustrates a distributed network 1000 according to a preferred embodiment of the present invention. Network 1000 includes a local multipoint distribution system (LMDS) access network 1002, ISP 1014 and the Internet 1004. LMDS access network 1002 allows broadband Internet access. IP traffic is generated between equipment 1006 connected to LMDS access such as a computer or a phone and Internet 1004 (or in some embodiments the intranet). An asynchronous transfer mode “ATM” switch 1008 (which is part of LMDS access network 1002) generate records 1009 (not shown) based on traffic transferred. Switch 1008 also aggregates records 1009 for a given IP user to give statistics 1010. Router 1016 generates IP traffic records 1018 describing the IP traffic transferred to and from LMDS access equipment 1006. An example of a commercially available product suitable for ATM switch 1008 is Lucent Cajun 500 manufactured by Lucent Technologies, headquartered in Murray Hill, N.J. An example of a commercially available product suitable for router 1016 is Cisco 7200, manufactured by Cisco Systems, Inc., headquartered in San Jose, Calif. Fraud apparatus 400 receives the records 1018 and statistics 1010. Assuming it is necessary in order to perform the comparison, fraud apparatus 400 aggregates records 1018 to produce statistics 1019 (not shown) for a given IP user and compares for a given IP user relevant fields in both sets of statistics 1010 and 1019.
Although the invention has been described for fraud detection, it should be evident that similar methods, systems and apparatuses could be used to detect other types of attempts to use the network improperly without causing financial loss, including security, attempts to break down part or all of the network, and service abuse. The term of “fraud” and “fraud event” should therefore be understood more generally.
Patent CitationsCited PatentFiling datePublication dateApplicantTitleUS5345595 *Nov 12, 1992Sep 6, 1994Coral Systems, Inc.Apparatus and method for detecting fraudulent telecommunication activityUS5592530Jan 25, 1995Jan 7, 1997Inet, Inc.Telephone switch dual monitorsUS6014557Mar 14, 1996Jan 11, 2000Bellsouth Intellectual Property CorporationApparatus and methods for providing wireless system fraud and visibility dataUS6298123 *May 7, 1999Oct 2, 2001Bell Atlantic Network Services, Inc.Interconnect traffic trackingUS6385444 *Oct 14, 1997May 7, 2002Detemobil Deutsche Telekom Mobilnet GmbhMethod and device for checking accuracy of call data records in telecommunications systemsUS6891938 *Nov 7, 2000May 10, 2005Agilent Technologies, Inc.Correlation and enrichment of telephone system call data recordsEP0714219A2Nov 14, 1995May 29, 1996AT&amp;T Corp.System and method for detecting cloning fraud in cellular PCS communicationsEP0805610A2May 2, 1997Nov 5, 1997Nokia Mobile Phones Ltd.Method and system for detection of fraudulent cellular telephone useWO1998039899A1Feb 23, 1998Sep 11, 1998Ameritech CorporationSystem and method for real-time fraud detection within a telecommunications systemWO1999013427A2Sep 11, 1998Mar 18, 1999Mci Worldcom, Inc.System and method for detecting and managing fraudWO2000025505A1Oct 28, 1999May 4, 2000Intervoice Limited PartnershipGeographically distributed multiple application network having a central databaseWO2000067460A1Apr 28, 2000Nov 9, 2000Nortel Networks LimitedMethod and system for fraud detection in telecommunicationsWO2001043402A2Dec 11, 2000Jun 14, 2001Mci Worldcom, Inc.Telephone fraud detection and prevention* Cited by examinerReferenced byCiting PatentFiling datePublication dateApplicantTitleUS7653932 *Aug 30, 2004Jan 26, 2010Arris GroupMethod and system for layer-3 subscriber login in a cable data networkUS7774842May 31, 2005Aug 10, 2010Verizon Business Global LlcMethod and system for prioritizing cases for fraud detectionUS7783019Aug 24, 2010Verizon Business Global LlcMethod and apparatus for providing fraud detection using geographically differentiated connection duration thresholdsUS7817791Oct 19, 2010Verizon Business Global LlcMethod and apparatus for providing fraud detection using hot or cold originating attributesUS7971237 *May 12, 2004Jun 28, 2011Verizon Business Global LlcMethod and system for providing fraud detection for remote access servicesUS8015414May 31, 2005Sep 6, 2011Verizon Business Global LlcMethod and apparatus for providing fraud detection using connection frequency thresholdsUS8340259 *Dec 8, 2009Dec 25, 2012Verizon Business Global LlcMethod and apparatus for providing fraud detection using hot or cold originating attributesUS8386253 *Jul 13, 2012Feb 26, 2013At&T Intellectual Property Ii, L.P.Systems, methods, and programs for detecting unauthorized use of text based communicationsUS8548811Jan 24, 2013Oct 1, 2013At&T Intellectual Property Ii, L.P.Systems, methods, and programs for detecting unauthorized use of text based communications servicesUS8638916May 31, 2005Jan 28, 2014Verizon Business Global LlcMethod and apparatus for providing fraud detection using connection frequency and cumulative duration thresholdsUS8848570 *Nov 6, 2012Sep 30, 2014Marvell International Ltd.Custom automatic remote monitoring for network devicesUS8886570Oct 29, 2013Nov 11, 2014Quisk, Inc.Hacker-resistant balance monitoringUS9173096Aug 22, 2013Oct 27, 2015At&T Intellectual Property Ii, L.P.Systems, methods and programs for detecting unauthorized use of text based communications servicesUS9184985 *Jun 8, 2009Nov 10, 2015Telefonaktiebolaget L M Ericsson (Publ)Investigating a communication aspect of a data flowUS20050050161 *Aug 30, 2004Mar 3, 2005Arnold Erich C.Method and system for layer-3 subscriber login in a cable data networkUS20050160280 *May 12, 2004Jul 21, 2005Caslin Michael F.Method and system for providing fraud detection for remote access servicesUS20050243984 *May 31, 2005Nov 3, 2005Mahone Saralyn MMethod and apparatus for providing fraud detection using hot or cold originating attributesUS20050249341 *May 31, 2005Nov 10, 2005Mahone Saralyn MMethod and apparatus for providing fraud detection using geographically differentiated connection duration thresholdsUS20050262563 *May 31, 2005Nov 24, 2005Mahone Saralyn MMethod and apparatus for providing fraud detection using connection frequency and cumulative duration thresholdsUS20050268113 *May 31, 2005Dec 1, 2005Mahone Saralyn MMethod and apparatus for providing fraud detection using connection frequency thresholdsUS20050278550 *May 31, 2005Dec 15, 2005Mahone Saralyn MMethod and system for prioritizing cases for fraud detectionUS20070106605 *Oct 26, 2005May 10, 2007International Business Machines CorporationApparatus and method for determining billable resources on a computer networkUS20100080372 *Apr 1, 2010Verizon Patent And Licensing Inc.Method and apparatus for providing fraud detection using hot or cold originating attributesUS20100235908 *Mar 13, 2009Sep 16, 2010Silver Tail SystemsSystem and Method for Detection of a Change in Behavior in the Use of a Website Through Vector AnalysisUS20100235909 *Sep 16, 2010Silver Tail SystemsSystem and Method for Detection of a Change in Behavior in the Use of a Website Through Vector Velocity AnalysisUS20120124207 *Jun 8, 2009May 17, 2012Telefonaktiebolaget L M Ericsson (Publ)Investigating a communication aspect of a data flowUS20120284017 *Jul 13, 2012Nov 8, 2012At& T Intellectual Property Ii, L.P.Systems, Methods, and Programs for Detecting Unauthorized Use of Text Based Communications* Cited by examinerClassifications U.S. Classification379/114.14, 379/127.02, 379/133, 379/145International ClassificationH04M15/00, H04M17/00, H04L29/06Cooperative ClassificationH04L63/104, H04L63/1416, H04L2463/102, H04L63/08, H04L63/0272European ClassificationH04L63/14A1, H04L63/02CLegal EventsDateCodeEventDescriptionDec 5, 2003ASAssignmentOwner name: ECTEL LTD., ISRAELFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:RONEN, DAVID;ADLER, DANIEL;REEL/FRAME:014771/0408Effective date: 20011009May 10, 2006ASAssignmentOwner name: ECTEL LTD., ISRAELFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:RONEN, DAVID;ADLER, DANIEL;REEL/FRAME:017599/0316Effective date: 20011209May 18, 2010FPAYFee paymentYear of fee payment: 4Mar 25, 2011ASAssignmentOwner name: CVIDYA 2010 LTD., ISRAELFree format text: CHANGE OF NAME;ASSIGNOR:ECTEL LTD.;REEL/FRAME:026026/0561Effective date: 20100505Apr 28, 2014FPAYFee paymentYear of fee payment: 8Jun 22, 2016ASAssignmentOwner name: AMDOCS DEVELOPMENT LTD., CYPRUSFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:CVIDYA 2010 LTD.;REEL/FRAME:038983/0406Effective date: 20160604RotateOriginal ImageGoogle Home - Sitemap - USPTO Bulk Downloads - Privacy Policy - Terms of Service - About Google Patents - Send FeedbackData provided by IFI CLAIMS Patent Services