Patent Description:
A call placed in a telephone network typically includes information regarding the originating number (or network number), a separate caller identifier number (otherwise referred to as the caller ID or presentation number) and the number being called (otherwise referred to as the destination number). Caller ID spoofing is the practice of causing a telephone network to indicate to the receiver of a telephone call that the number from which an originator of the call is calling is different from their true originating number. A call in which the Caller Identifier Number reflects a different number (the spoofed number) from the true originating number may be referred to as a spoofed call. Under ideal conditions, an operator of a telephone network should be able to distinguish calls where the Caller ID has been altered by checking whether it matches the originating number information for the call. However, in a deregulated world, with many operators, each having different practices and providing varying level of assurance on the validity of an originating number or Caller ID, it can be hard for a network operator to ensure that a specified originating number (as well as other fields in the signalling for a call) is correct, especially where calls originate from a different network. This issue is amplified by the advent of IP telephony. It can therefore be hard to identify calls where Caller ID spoofing is occurring.

Whilst there are various legitimate uses of Caller ID spoofing, it is increasingly being used for nefarious purposes. For example, various techniques for blocking calls (such as by blacklisting or whitelisting numbers) from undesirable callers are known. However, Caller ID spoofing may be used as part of an attempt to circumvent such blocking systems by making the calls appear to come from a number belonging to a reputable company whose calls would not be blocked. Another use of Caller ID spoofing is as part of fraudulent social engineering techniques designed to convince the called party that the caller is from the reputable company whose number is being spoofed in order to convince them to carry out actions or divulge confidential information that they would not otherwise do. Since fraudsters carrying out this kind of activity also typically make use of automated calling in order to reach their victims, spoofing the Caller ID of a reputable company may also help them avoid attempts to block unwanted automated calls. In other situations, a more malicious entity might spoof the Caller ID's of vital organisations, such as hospitals, the police, banks and so on in order to fill the network with deceptive calls resulting in a denial of service.

In <CIT>, a device may receive a call request to initiate a VoIP call. The device may analyze the call request, based on call pattern information of a quantity of other calls, to determine whether the call request is suspicious.

It is therefore desirable to provide a mechanism for providing assurance that a series of calls are likely to have come from a genuine source (such as the owner or authorised user of a telephone number) or that indicates that spoof calls are likely being made that provide the illusion of coming from that source.

According to a first aspect of the invention, there is provided a computer-implemented method of processing calls in a telephone network according to claim <NUM>.

Through the use of a predetermined order for calling telephone numbers, which is known and adhered to by the owner of a telephone number, the presence of spoofed calls being placed using that telephone number can be detected.

The method may further comprise: identifying a largest subset of the plurality of calls for which a sequence in which the subset of calls was placed corresponds to a correct order for calling those telephone numbers; and classifying any calls belonging to the largest subset as being legitimate calls and any calls not belonging to the largest subset as being spoofed calls.

Through the identification of the largest subset of calls that are in a correct order, the spoofed calls that have been made can be identified.

The may further comprise: identifying the latest legitimate call; and classifying a further call made by the particular telephone number as a spoofed call if a telephone number that is called is earlier in the predetermined order than a telephone number of the latest legitimate call. The method may block further calls in response to classifying the further call as a spoofed call.

Through the identification of the latest legitimate call, at least some subsequent spoofed calls can be identified as they are being placed, enabling appropriate action to block or screen those calls to be taken, whilst the probability of accidentally affecting any subsequent genuine calls is low.

The method may share a secret with a party that is authorised to use the particular telephone number, the secret determining the predetermined order for calling a set of telephone numbers. The secret may be received from the party or provided to the party that is authorised to use the particular telephone number. The secret may comprise an operation that produces a numerical value from a telephone number, the predetermined order may be based on the respective numerical values produced by the operation for each of the called telephone numbers. The predetermined order may be generated by placing the respective numerical values for each of the called telephone numbers in either ascending or descending order. The secret may comprise a cipher or a hashing function.

The method further may further comprise causing one or more predetermined actions to be taken in response to determining that one or more of the calls were made by spoofing the particular telephone number. The one or more predetermined actions may comprise notifying the party which is authorised to use the particular telephone number that calls are being made by spoofing that telephone number.

According to a second aspect of the invention, there is provided a computer-implemented method of placing calls in a communications network carrying out the method of the first aspect, comprising: sharing a secret between a party authorised to use a particular telephone number and the communications network, the secret determining the predetermined order for calling a set of telephone numbers; using the secret to determine an order for a plurality of telephone numbers to be called; calling, from the particular telephone number, the plurality of telephone numbers in sequence according to the determined order.

According to a third aspect of the invention, there is provided a computer system comprising a processor and a memory storing computer program code for performing the methods set out above. According to a fourth aspect of the invention, there is provided a computer program which, when executed by one or more processors, is arranged to carry out the methods set out above.

Embodiments of the present invention will now be described by way of example only, with reference to the accompanying drawings, in which:.

<FIG> is a schematic depiction of an exemplary telephone network <NUM> within which embodiments of the invention may operate. The exemplary telephone network <NUM> may also be referred to as a communications network. The exemplary telephone network <NUM> is a conventional telephone network comprising a plurality of core exchanges <NUM>, a plurality of local exchanges <NUM>, a plurality of customer telephony terminals <NUM>, one or more domestic gateways <NUM>, one or more international gateways <NUM>, one or more voicemail servers <NUM>, one or more call data stores <NUM> and one or more analyst terminals <NUM>.

The core exchanges <NUM> are interconnected by a plurality of communications links <NUM>. Each of the plurality of core exchanges <NUM> are further connected to one or more local exchanges by further communications links <NUM> (although, for the sake of clarity, not all of the core exchanges <NUM> illustrated in <FIG> are shown as being connected to local exchanges <NUM>).

The local exchanges <NUM> are each connected to a respective core exchange <NUM> via a respective communication link <NUM>. Each of the local exchanges <NUM> is also connected to a respective subset of the customer telephony terminals <NUM> via yet further communications links <NUM> (although again, for the sake of clarity, this is not shown for each of the local exchanges <NUM> in <FIG>).

The customer telephony terminals <NUM> are each connected to a respective local exchange <NUM> via a respective communication link <NUM>. The customer telephony terminals <NUM> can include devices such as telephones, private branch exchanges (PBX), conference phones, computer diallers, fax machines, modems, answering machines and so on.

The domestic gateways <NUM> are each connected to one or more other telephony networks (not shown) in the same country. The domestic gateways <NUM> enable calls to be routed between the telephone network <NUM> and the other telephony networks. That is to say, the domestic gateways <NUM> enable the customer telephony terminals <NUM> within the telephone network <NUM> to place calls to and/or receive calls from telephony terminals within the other telephony networks.

The international gateways <NUM> are each connected to one or more other international telephony networks (not shown). The international gateways <NUM> enable calls to be routed between the telephone network <NUM> and the other international telephony networks. That is to say, the international gateways <NUM> enable the customer telephony terminals <NUM> within the telephone network <NUM> to place calls to and/or receive calls from telephony terminals within the other international telephony networks.

The voicemail servers <NUM> are connected to the telephone network <NUM> via respective communications links <NUM>. They may be connected at any point in the telephone network <NUM>, such as at core exchange <NUM> as shown in <FIG>. Although not illustrated in <FIG>, voicemail servers <NUM> may also or alternatively be connected to a local exchange <NUM>. Each of the voicemail servers <NUM> provides a voicemail facility to a plurality of customers of the telephone network <NUM>. For example, a voicemail server <NUM> connected to a local exchange <NUM> might provide a voicemail facility for the customers whose telephony terminals <NUM> are directly connected to that local exchange <NUM>. Of course it will be appreciated that a multitude of other arrangements are possible.

The call data stores <NUM> each store a plurality of call data records representing some or all of the telephony calls made over the telephone network <NUM> for a given period of time. Each call data record will comprise the telephone number used by the calling party, the telephone number of the called party, the time that the call started and the time that the call was terminated (or a time that the call started or ended and a duration of the call). The call data is provided periodically to the data stores by the one or more local exchanges <NUM> (and/or, in some embodiments, by the core exchanges <NUM>) as calls are placed, connected and terminated in the telephone network <NUM>. The provision of the call data is provided to the data stores <NUM> using any appropriate means of communication, such as by using a data network that is separate from the telephone network <NUM>. As will be appreciated, each data store, may receive data from different sets of local exchanges <NUM>, such that call data for the network <NUM> as a whole is spread across the data stores <NUM>.

The analyst terminals <NUM> are computer systems which can access the data stored in the data stores <NUM> (or, at least, in some of the data stores <NUM>). Programs may run on the analyst terminals <NUM> to analyse the call data stored in the data stores <NUM> including, for example, to classify whether particular callers are a source of automated telephone calls, in accordance with embodiments of this invention.

As is well known, calls made by a customer telephony terminal <NUM> are initially handled by the local exchange <NUM> to which the terminal <NUM> is connected via its respective communication link <NUM>. If the destination of the call is another terminal <NUM> that is connected to the same local exchange <NUM>, that local exchange <NUM> can route the call directly to its destination without involving any of the other components of the telephone network <NUM>. Otherwise, if the destination terminal <NUM> is not on the same local exchange <NUM>, the local exchange <NUM> routes the call to the respective core exchange <NUM> to which it is connected to handle the further routing of the call. If the call is destined for another terminal <NUM> on the network, the core exchange <NUM> routes the call, possibly via one of the other core exchanges <NUM>, to the local exchange <NUM> to which that terminal <NUM> is connected. However, if the call is destined for a terminal on another network, the core exchange <NUM> routes the call to one of the gateways for onward routing to that network. In some cases, instead of routing a call to a customer's telephony terminal <NUM>, the telephone network <NUM> can instead route a call to one of the voicemail servers <NUM> which provides a voicemail facility for that customer. The caller can then leave a message which will be recorded by the voicemail server <NUM> and can later be replayed by the customer at a time convenient to them. If a call is routed to the voicemail a notification such as a computer or smartphone notification, an SMS message and/or an email will be sent to the customer informing them of the presence of an unheard voicemail on the voicemail server <NUM>. The decision to route a call to one of the voicemail servers <NUM> may be made if, for example, there is no answer from the customer's telephony terminal <NUM> after a predetermined number of rings or if a customer has specified that all calls should be redirected to their voicemail.

It will be understood that the telephone network <NUM> illustrated in <FIG> is merely exemplary and that various modifications may be made according to the needs of a specific telephone network. In some embodiments, various components described above may be absent from the telephone network <NUM>. For example, the network <NUM> might not include domestic gateways <NUM> and/or international gateways <NUM> if such connectivity to other networks is not required. Similarly, the telephone network <NUM> might not include voicemail servers <NUM> if no voicemail service is offered to customers of the network <NUM>. Furthermore a wide range of other components not illustrated in <FIG> may be present in the telephone network <NUM>. Indeed, in general, it will be appreciated that there are many different forms that telephone network <NUM> may take using different combinations, numbers, types and arrangements of these components.

<FIG> shows a flowchart describing how a method <NUM> according to the present invention can be implemented to process calls in a communications network, such as the network <NUM> illustrated in <FIG>. The method <NUM> starts at an optional operation <NUM>.

At optional operation <NUM>, the method <NUM> shares a secret with a party that is authorised to use the particular telephone number (e.g. the owner of the telephone number). The secret which is shared enables a predetermined order for calling a set of telephone numbers to be generated. In some embodiments, the secret is provided by the party that is authorised to use the telephone number (for example, the party may generate the secret and provide it to the network). In other embodiments, the secret is provided by the network (for example, the network may generate the secret and provide it to the network). Any suitable secure mechanism may be used to exchange the secret between the network and the party that is authorised to use the telephone number, as will be known by the skilled person. The secret may be an operation that produces a numerical value from a telephone number. That is to say, it is a function which takes a telephone number as an input and outputs a numerical value. The predetermined order of the telephone numbers can therefore be determined by the associated numerical values that are produced when the telephone numbers are processed by the operation, for example by using an ascending or descending order based on those values. The secret may comprise a cipher or hashing function (or any other kind of mapping from telephone numbers to another number).

As an example, a mapping may be used to map the local customer element of a telephone number (i.e. the number excluding the standard area codes and so on). This mapping could, for example, map the numbers <NUM>-<NUM> to a different ordering of the numbers <NUM>-<NUM>, that is to say the number <NUM> might be mapped to the number <NUM>, the number <NUM>, might be mapped to the number <NUM>, the number <NUM> might be mapped to the number <NUM> and so on. This mapping can then be used, for example, to map pairs of digits in the local customer element of a telephone number to a numerical value, thereby yielding a different number for each telephone number. For example, if the local customer element of a telephone number has <NUM> digits in the format ABCDEF, the first two digits of the telephone number AB could be mapped to a different number A'B', the second two digits of the telephone number CD could be mapped to a different number C'D' and the final two digits of the telephone number EF could be mapped to a different number E'F', thereby yielding the number A'B'C'D'E'F' for the telephone number. The same mapping could be used for each pair of numbers, or alternatively different mappings could be provided for each pair (that is a first mapping could be provided for mapping digits AB, a second mapping could be provided for mapping digits CD and a third mapping could be provided for mapping digits EF).

Of course it will be appreciated that any appropriate secret (including any suitable hashing, mapping and/or cipher functions) that enables a particular ordering of telephone numbers to be determined can be used. In another example, the secret is simply a list of telephone numbers ordered in a particular way. That is to say, a list of telephone numbers that a party wishes to call may be provided to the network and the network may return that list of telephone numbers ordered in an order that they are to be called.

Having shared a secret with the owner of a telephone number, the method <NUM> proceeds to an operation <NUM>. Of course, it will be appreciated that in some embodiments, the predetermined ordering of telephone numbers could simply be widely published (such as, for example, by a network operator stating that telephone numbers should be called in numerical order (ascending or descending) of the telephone numbers themselves). In such embodiments, it is not necessary to share a secret with the owner of the telephone number and the method <NUM> can start with operation <NUM>. Nonetheless, it is believed that by using a secret shared with the owner of a telephone number (at operation <NUM>), the method <NUM> will be better able to detect the presence of spoofed calls for that telephone number by making it harder for a party placing spoofed calls to attempt to place calls in a correct order.

In some embodiments, the sharing of the secret at step <NUM>, may be considered to indicate to the network <NUM> that the owner of the telephone number is about to start a calling campaign which they would like the network to monitor to detect any spoofed calls. In other embodiments, the owner of the telephone number may notify the network separately that the calling campaign is about to begin. Of course, it is not necessary for the network to be notified of calling campaigns in order for the invention to work, however doing so may be useful to allow resources to be allocated for the monitoring of numbers at appropriate times.

However, in other embodiments, the network may monitor the calls without receiving any notification from the owner of a telephone number.

At operation <NUM>, the method <NUM> identifies a plurality of calls that have been made by a particular telephone number to telephone numbers in the communications network. For example, the call data records relating to that telephone number may be retrieved from the call data stores <NUM>. As will be appreciated, these call data records will include any calls which were made by spoofing the telephone number, as well as those that were genuinely made by the owner of the telephone number.

At operation <NUM>, the method <NUM> determines whether a sequence in which the calls were placed corresponds to a correct order for calling those telephone numbers. That is to say, whether the sequence of calls is a subsequence of the predetermined order for calling the telephone numbers in the communications network. In other words, the method <NUM> checks each call in the sequence, to ensure that it is to a telephone number that appears later in the predetermined order than a previously called telephone number in the sequence (i.e. that the called telephone number does not appear earlier in the predetermined order than a previously called number in the sequence of calls that were made). In embodiments where a secret is shared with the owner or authorised user of the telephone number, the method <NUM> uses that secret at operation <NUM> to determine whether the sequence of calls that were made follows a correct order. For example, the method <NUM> may use an operation (in embodiments where the secret is an operation such as a mapping, cipher or hash) to determine the number associated with each of the called telephone numbers - these numbers can then be used to determine whether the calls were placed in a correct order (e.g. such that the numbers associated with each called telephone number are in an ascending (or descending) order).

If, at operation <NUM>, the method <NUM> determines that the sequence in which the calls were placed is not correct (that is to say that it does not correspond to the predetermined order for calling the telephone numbers in the communications network), then the method <NUM> determines that one or more of the plurality of calls were made by spoofing the particular telephone number under consideration.

Accordingly, in some embodiments, the method <NUM> may proceed to an operation <NUM> in which it causes one or more predetermined actions to be taken in light of this determination. For example, the method <NUM> can notify an operator of the network and/or an owner (and/or authorised user) of the telephone number that calls are being made by spoofing that telephone number, such as by raising an alarm. The method <NUM> then ends.

However, If it is determined at operation <NUM> that the sequence in which the calls were placed is correct according to the predetermined order, then it is determined that no spoofing is taking place. Accordingly, in some embodiments, the method <NUM> ends. However, in other embodiments (not shown by the flowchart of <FIG>), various predetermined actions may be taken following a determination that no spoofing is taking place, such as providing the owner of the telephone number with a positive indication that no spoofing of their number is occurring.

<FIG> is a schematic illustration of exemplary sequences of calls being placed within a telephone network, such as the telephone network <NUM>, in accordance with embodiments of the invention. Specifically, <FIG> illustrates a sequence of calls <NUM> which is made by a first party <NUM>, a sequence of calls <NUM> which is made by a second party <NUM>, and the resulting sequence of calls <NUM> which is seen by an operator <NUM> of the network <NUM>.

The first party <NUM> is the owner or authorised user of a particular telephone number. The first party <NUM>, places calls in a particular order in accordance with the present invention. As discussed above, in some embodiments, this may simply involve the first party making calls in an order that is widely published by the network operator <NUM>, such as for example, by making calls in an ascending (or descending) numerical order of the number that is dialled. In other embodiments, the first party <NUM> may share a secret with the network operator <NUM>. That is to say, the first party <NUM> may provide a secret to the network operator <NUM> or, alternatively, may receive a secret from the network operator <NUM>. As discussed above, this secret enables a predetermined order for calling a set of telephone numbers to be generated. In any case, the first party <NUM> determines what a correct order for calling a particular set of numbers that it intends to call is (according to the predetermined order) and places calls <NUM> to those numbers in that order.

The second party <NUM> illustrated in <FIG> is a party that is engaged in spoofing the particular telephone number belonging to the first party <NUM>. That is to say, the second party <NUM> is placing calls <NUM> which specify the caller ID and/or originating number as being the particular telephone number owned by the first party <NUM> despite the fact that the second party <NUM> is not authorised to use the particular telephone number.

The operator <NUM> of a telephone network <NUM> through which some of the calls are processed is unlikely to see all of the calls that are made by the first party <NUM> or the second party <NUM>. This is because, either the first party <NUM> or the second party <NUM>, or both, may belong to a different network than the telephone network <NUM> that is outside the control of the operator <NUM>. Similarly, some of the numbers called by the first party <NUM> or the second part <NUM> or both may also be outside of the telephone network <NUM>. Accordingly, the operator <NUM> may only be aware of those calls which are made to numbers within the telephone network <NUM> (and not other calls that are placed to numbers belonging to other networks). Therefore, the sequence of calls <NUM> represents the amalgamation of calls <NUM> placed by the first party <NUM> and calls <NUM> placed by the second party <NUM> as seen by the operator <NUM>. As can be seen, this amalgamated sequence of calls <NUM> that is seen by the operator <NUM> does not include the <NUM>nd, <NUM>th, <NUM>th, <NUM>th or <NUM>th calls in the sequence of calls <NUM> made by the first party <NUM>, as these calls represent calls being made to other numbers that are not part of the telephone network <NUM> operated by the operator <NUM>. Similarly, other calls <NUM> may be placed by the second party to numbers that are not part of the telephone network <NUM> and these too will be absent from the amalgamated sequence of calls <NUM> that is seen by the operator <NUM>. Nonetheless, the operator <NUM> can still apply the method <NUM> to determine whether the sequence of calls <NUM> includes any spoofed calls. That is to say, by applying method <NUM>, the operator <NUM> can detect the existence of the second party <NUM> that is making unauthorised use of the particular telephone number. Specifically, when considering the sequence of calls <NUM> which represent the calls made from the particular telephone number from the operator's perspective, the operator can ascertain that the sequence of calls <NUM> is not correctly ordered (that is, it does not correspond to a predetermined order that the calls should have been made in). This is evident after the first three calls, which are to telephone numbers which should appear in positions <NUM>, <NUM> and <NUM> of the predetermined order for those telephone numbers. However, since the telephone number in the <NUM>th position of the predetermined order has been called before the <NUM>rd number of the predetermined order (where a correct order would be for the telephone number in the <NUM>th position to be called after the telephone number in the <NUM>rd position), the operator <NUM> can safely conclude that spoofing is occurring for this particular telephone number. It is worth noting, for completeness, that it would not be possible for the operator <NUM> to ascertain the presence of spoofing after just the first two calls (in this particular case). This is because, in the example illustrated by <FIG>, the first call is to the telephone number in the <NUM>st position of the predetermined order and the second call is to the telephone number in the <NUM>th position of the predetermined order and therefore the order of these two calls is correct according to the predetermined order. Although at this point the operator is not aware of calls being made to the numbers in positions <NUM>-<NUM> of the predetermined order, the operator can only assume that either the first party did not want to call these telephone numbers, or else that calls to these numbers utilised other networks, or some combination of the two. As will be appreciated, there are many different permutations of calls that can be made that maintain a correct ordering of the calls based on the predetermined ordering of the telephone numbers - all that is required for the order to be correct is that a number earlier in the predetermined order is not called after a number which is later in the predetermined order. Nonetheless, since the second party <NUM> does not know about the calls <NUM> that are being made by the first party <NUM>, it will be hard, if not impossible, for them to make calls in such a way that the correct ordering of the calls is maintained so as to avoid detection, even if the required ordering is known by the second party <NUM>. Of course, the chances of the second party <NUM> avoiding detection are likely to be even lower when the required ordering is based on a secret shared between the network <NUM> and the first party <NUM>, which is not known to the second party <NUM>.

It will be appreciated that the example of <FIG>, as discussed above, has been simplified in order to more clearly illustrate the invention. For example, in reality, there could be additional parties making additional spoofed calls. Such additional spoofed calls would largely be viewed the same from the network operator's perspective and simply appear as additional calls in the amalgamated sequence of calls <NUM> that is seen by the operator <NUM>. Additionally, it will be appreciated that it is merely coincidental that the genuine calls <NUM> made by the first party <NUM> occupy the same number slot in the sequence observed by the operator <NUM> as their order in the predetermined sequence (i.e. that call <NUM> in the sequence of calls made by the first party occupies the <NUM>st position in the sequence observed by the operator and that call <NUM> occupies the <NUM>rd position and so on). This need not be the case (and indeed, is unlikely to be so). For example, if the second party <NUM> had made an additional call between the <NUM>st and <NUM>rd calls made by the first party <NUM>, the <NUM>rd call made by the first party <NUM> would occupy the <NUM>th position in the sequence <NUM> observed by the operator <NUM> instead.

The exemplary sequences of calls illustrated in <FIG> will now be discussed further in conjunction with <FIG> which is a flowchart illustrating a method <NUM> of processing calls in a telephone network, such as telephone network <NUM>, according to embodiments of the invention. This method is a development of the method <NUM> illustrated in <FIG>. In particular, the method <NUM> illustrated by <FIG> additionally classifies each of the calls that are made using the particular number as being either genuine or spoofed, to allow further action to be taken in respect of the spoofed calls.

As discussed above for the method <NUM> illustrated in <FIG>, the method <NUM> can begin with the optional operation <NUM> of sharing a secret with the owner or authorised user of a particular telephone number. The method <NUM> then proceeds to an operation <NUM>, which is also as discussed above in relation to the method <NUM> illustrated in <FIG>. As previously discussed, in some embodiments, the method <NUM> may skip optional operation <NUM> and begin instead with operation <NUM> (for example, where the operator <NUM> widely publishes a technique for determining an ordering of making calls that is not specific to any one telephone number). Either way, after identifying previous calls that were ostensibly made using the particular telephone number (from the network operator's perspective) at operation <NUM>, the method <NUM> then proceeds to an operation <NUM>.

At operation <NUM>, the method <NUM> identifies a largest subset of the plurality of calls that were made using the particular telephone number which provide a sequence of calls having a correct order according to the predetermined order for calling numbers. Appendix A below shows exemplary code using the Julia programming language which can be used to identify this largest subset.

For illustration, some examples subsets of the plurality of calls which have a correct order for the exemplary calling sequences illustrated in <FIG> are set out in the table below.

As can be seen, the largest subset which provides a correct order of calls is the subset containing the <NUM>st, <NUM>rd, <NUM>th, <NUM>th, <NUM>th, <NUM>th and <NUM>th calls in the sequence observed by the operator <NUM>. Having identified the largest subset of the plurality of calls, the method <NUM> proceeds to an operation <NUM>.

At operation <NUM>, the method <NUM> classifies any calls belonging to the largest subset as being legitimate calls and any calls not belonging to the largest subset as being spoofed calls. Returning to the largest subset identified in the example illustrated in <FIG>, it can be seen that this largest subset contains all of the calls which were made by the first (genuine) party <NUM> and none of the spoofed calls made by the second (unauthorised) party <NUM>. Accordingly, the spoofed calls can be identified as being any calls not contained in this largest subset (i.e. the <NUM>nd, <NUM>th, <NUM>th, <NUM>th and <NUM>th calls).

Although not shown in <FIG>, the method <NUM> may optionally make use of this information regarding spoofed calls which have recently been made using a particular telephone number to take action to help mitigate some of the potential negative impact that those calls might have. For example, in some embodiments, the owner or authorised user of the particular telephone number may be notified of spoofed calls that have recently been made using their telephone number. This can allow the owner of the telephone number to contact any of their customers who may have been affected or more closely monitor accounts associated with those customers to help prevent any fraudulent activity. Other uses for this information will be readily apparent to the skilled person.

Where classification of past calls is the only concern, the method <NUM> may simply end at this point (not shown), possibly to be repeated after a certain amount of time has elapsed so as to provide updated information. However, as will be discussed below, the classification of these calls in operation <NUM> can also be used to block at least some of the spoofed calls that could be made by the second (or indeed any other) party <NUM> in the future. Accordingly, the method <NUM> preferably proceeds to an operation <NUM>.

At operation <NUM>, the method <NUM> identifies the latest legitimate call. The latest legitimate call is the call in the largest subset of numbers that was identified at operation <NUM> which was placed most recently. In the exemplary call sequences illustrated in <FIG>, the most recent call is the <NUM>th call which is to the telephone number that is ordered <NUM>th in the predetermined ordering of telephone numbers. Having identified the latest legitimate call, the method <NUM> proceeds to an operation <NUM>.

At operation <NUM>, the method <NUM> waits for any further calls to be made using the particular telephone number under consideration. In the example illustrated by <FIG>, the second user <NUM> places a new spoofed call to the telephone number that is <NUM>th in the predetermined ordering of telephone numbers. When a new call is placed to a telephone number that is on the operator's network <NUM>, the method <NUM> proceeds to an operation <NUM>.

At operation <NUM>, the method <NUM> classifies the further call made by the particular telephone number as a spoofed call if a telephone number that is called is earlier in the predetermined order than the latest legitimate call. In particular, it will be appreciated that the latest legitimate call effectively sets a bound on the numbers that can be called by any future genuine calls. Specifically, any subsequent calls that are made by the first (genuine) user <NUM> will only be to numbers that appear later in the ordering of the set of numbers than the latest legitimate call. Therefore, if a call is made to a number that appears earlier in the ordering of the set of numbers, it can safely be concluded that that call is a spoofed call. In the example illustrated in <FIG>, any genuine further calls can only be to numbers that are in position <NUM> or higher of the predetermined order as the latest legitimate call was to the <NUM>th number in the predetermined order. In some embodiments, any further calls which are classified as spoofed calls in this way are blocked, preventing the call from reaching the destination number. Of course, any desired way of handling further calls which are classified as being spoofed may be used, including for example, directing the spoofed calls to a voicemail service for the destination number and providing a warning to a user of the destination number to exercise caution due to the fact that the voicemail came from a spoofed number (conceptually similar to a junk e-mail folder for voicemail) or alerting the operator of the network that a spoofed call is in progress Alternatively or additionally, the method <NUM> can notify the network from which the spoofed calls originated that the calls have been identified as using a spoofed Caller ID, this enables the originating network to take various actions to help rectify the spoof calling including, for example, ceasing to propagate Caller IDs for that number to the network <NUM>. In the example illustrated by <FIG>, the second user's new spoofed call is classified as a spoofed call and blocked from reaching the destination number because the destination number appears earlier (<NUM>th) in the predetermined order of telephone numbers than the latest legitimate call (which is <NUM>th). The method <NUM> then proceeds to an operation <NUM>.

At operation <NUM>, the method <NUM> determines whether the call that has been identified as the latest legitimate call should be updated. In particular, although it is safe to conclude that a call made to a number that appears earlier in the ordering of the set of numbers than the latest legitimate call is a spoofed call, the same is not true in reverse. In other words, a further call to a number which appears later in the order of the set of numbers than the latest legitimate call is not necessarily a genuine call - it could still be a spoofed call. Accordingly, the method <NUM> may regularly occasionally return to operation <NUM> to recalculate the latest legitimate call by analysing an updated set of calls placed from the particular number under consideration. For example, the processing to identify the latest legitimate call can be conducted periodically or after a certain number of further calls have been made. Of course, in some embodiments, the latest legitimate call can simply be calculated once, that is to say, the method <NUM> may omit operation <NUM>. In such embodiments, it is still likely that a proportion of further spoofed calls can be identified and dealt with even though the proportion could be improved by refining the bound for later calls, through the identification of a later legitimate call. The method <NUM> then proceeds to an operation <NUM>.

At operation <NUM>, the method <NUM> determines whether it should continue waiting for further calls to be made, in which case the method <NUM> returns to operation <NUM>. Otherwise, the method <NUM> ends. The determination to end the method <NUM> could be based, for example, on notification by the first party <NUM> that they do not wish the network <NUM> to monitor their telephone number for spoofing any more - possibly, for example, when a calling campaign has ended. As a further example, the method could end after a certain amount of time has elapsed. In this case, the method could be restarted again, possibly using a new secret or otherwise allowing for a reset in the observed sequences to occur. Of course in other examples, the method <NUM> may simply be run sporadically such as at the request of the owner of the telephone number. In this case, the owner of the telephone number may generate a secret and place the calls according to the order determined by the secret and then, only after the calls have been made, provide the secret to the network and ask the network to check whether any spoof calls were made during a particular time period. Whilst this would prevent the network from being able to detect spoof calls as they are being made, it provides a mechanism by which the owner of a telephone number can opt to use the service on an ad-hoc basis where they have suspicions that spoofing of their number has taken place.

The methods <NUM> and <NUM> discussed above make use of the likelihood of a spoofed call appearing in a correct order compared to other calls that have been made using a particular number being low, thereby providing a high probability that spoofed calls will be detected.

Given a range r of numbers of numbers being dialled by the first (genuine) party <NUM> and an average interval i (that is the average encoded gap or the distance between the telephone numbers in the predetermined order) between numbers in that range which are dialled by the first party <NUM>, then the probability p of a spoofed call being successfully inserted (i.e. such that it is in the correct order and thereby avoids detection) by the second party <NUM> can be considered to be: <MAT>.

If the second party <NUM> makes n spoofed calls, the probability p of at least one of those being successfully inserted (i.e. such that it escapes detection) can be considered to be: <MAT>.

Therefore, in a sequence of k genuine calls made by the first party <NUM>, the probability p of a successful insertion in that sequence can be considered to be: <MAT>.

Accordingly, the ratio of genuine calls to (undetected) spoofed calls can be considered to be: <MAT>.

The worst case performance will be seen when the number spoof calls significantly outnumber genuine calls being made by the owner or authorised user of a particular number. In reality, this is rare because spoof callers are typically wary of drawing too much attention to their activities by generating too many spoofed calls and possibly also because doing so could limit the effectiveness of their activities by raising awareness in the minds of users that calls are likely to be spoofed. However, even under these unlikely worst case operating conditions, these methods are likely to detect at least some of the spoofed calls that are being made.

In experiments, a probability of spotting a single spoofed call was determined to be approximately <NUM> where a ratio of genuine calls to spoofed calls of <NUM>:<NUM> (which is expected to be an untypically high ratio). Using this minimum observed probability, the binomial distribution can be used to calculate the probability of failing to spot any spoofed calls for a given number n of spoofed calls. As will be known, the binomial distribution is given as: <MAT> , where p is the probability of success, q is the probability of failure (i.e. q = p - <NUM>) and k is the number of successes in n trials. In this case, the probability of success p is the probability of spotting a spoofed call. A failure to spot any of the spoofed calls is therefore given by P(<NUM>), i.e.: <MAT>.

<FIG> shows a chart illustrating the probability of failing to spot any of the spoofed calls as the number of calls increases based on a minimum probability of spotting a single spoofed call observed during experiments. As is apparent, the probability P(<NUM>) of failing to spot any of the spoofed calls will decrease as the number of spoofed calls n increases. Therefore, even at this minimum probability of spotting a single spoofed call of <NUM>, the probability of missing <NUM> spoofed calls, for example, is <NUM>. Bearing in mind that this minimum probability requires a high ratio of spoofed calls to genuine calls, such that the number of spoofed calls is likely to be high, the probability of detecting that spoofing is taking place is high, even in this scenario.

Accordingly, by allowing the presence of spoofed calls for a telephone number to be detected, the above-described methods enable an identity of an owner or authorised user of the telephone number to be better asserted on the voice network. These methods may also allow some of the spoofed calls to be screened, reducing a load on the network and potentially reducing fraud or the impact of any denial of service attacks utilising spoofed Caller IDs. Furthermore, these methods can operate using customers' existing telephone equipment and do not require the receiving customers (that is the numbers which are called by an owner of a telephone number or a spoof caller) to adapt in any way in order to provide these benefits. Additionally, these methods can be used by a network operator without needing to introduce any new in-network signalling systems.

Suitably, the computer program is stored on a carrier medium in machine or device readable form, for example in solid-state memory, magnetic memory such as disk or tape, optically or magneto-optically readable memory such as compact disk or digital versatile disk etc., and the processing device utilises the program or a part thereof to configure it for operation. The computer program may be supplied from a remote source embodied in a communications medium such as an electronic signal, radio frequency carrier wave or optical carrier wave. Such carrier media are also envisaged as aspects of the present invention. It will be understood by those skilled in the art that, although the present invention has been described in relation to the above described example embodiments, the invention is not limited thereto and that there are many possible variations and modifications which fall within the scope of the invention as defined by the appended claims. The scope of the present invention includes any novel features or combination of features disclosed herein. The applicant hereby gives notice that new claims may be formulated to such features or combination of features during prosecution of this application or of any such further applications derived therefrom.

Claim 1:
A computer-implemented method (<NUM>) of processing calls in a telephone network (<NUM>), the method comprising:
identifying (<NUM>) a plurality of calls (<NUM>) that have been made by a particular telephone number to telephone numbers in the telephone network;
characterised by:
determining (<NUM>) whether a sequence in which the calls were placed corresponds to a correct order for calling those telephone numbers, the correct order being determined based on a predetermined order for an authorised user of the particular telephone number to call telephone numbers in the telephone network; and
determining that one or more of the calls were made by spoofing the particular telephone number if the sequence in which the calls were placed does not correspond to a correct order.