EP4118810A1

EP4118810A1 - Method for detecting fraudulent or abusive use of a telephone service provided by a telephone operator

Info

Publication number: EP4118810A1
Application number: EP20726886.3A
Authority: EP
Inventors: Christophe Scholer
Original assignee: Araxxe
Current assignee: Araxxe
Priority date: 2020-03-11
Filing date: 2020-03-11
Publication date: 2023-01-18
Also published as: US20230120157A1; WO2021181012A1

Abstract

Method for detecting fraudulent or abusive use of telephone services comprising the following steps: collecting data on telephone communication exchanges carried out over a given study period from/to telephone numbers and involving roaming and/or interconnection; creating individual files for compiling exchange data for each studied number; revaluing communications based on pre-established revaluation rules to obtain a wholesale cost amount for each studied number; a step E4 of identifying suspicious numbers for which the amount of wholesale costs exceeds a predetermined threshold value over the study period; a step E7 of detecting fraudulent use by analysing exchange data compiled in the files associated with the identified numbers and/or the multiparametric indicators obtained from said data.

Description

FRAUDULENT OR ABUSIVE USE OF A TELEPHONY SERVICE PROVIDED BY A TELEPHONY OPERATOR

TECHNICAL AREA

The present invention relates to the general technical field of telecommunications, and in particular telephone communications.

The present invention relates more specifically to the technical field of methods for detecting fraudulent or abusive use of at least one telephone service provided by a telephone operator, and this in the particular case of telephone communications involving a roaming situation. and / or interconnection of telephone networks.

PRIOR TECHNIQUE

Telephone operators provide their own customers as well as third-party telephone operators with a number of telephone services on a daily basis for carrying out telephone communications through one or more telephone, mobile and mobile networks. / or fixed. In particular, the telephony services provided are intended to allow the establishment and implementation of telephone communications involving a situation of roaming and / or interconnection of telephone networks, nationally and internationally.

For many years, telephone operators have been confronted with fraudulent or at the very least abusive use of the telephone services they offer, by third parties who take advantage of certain breaches in the technical infrastructure or advantageous financial conditions which may be associated with said telephony services to carry out arbitrations allowing them to generate a financial gain, or at the very least a financial saving, to the detriment of the telephony operator. Such fraudulent or abusive uses are encouraged in particular by a continuous development of offers offering, at ultra-competitive rates, so-called unlimited telephone calls, as well as an evolving regulatory framework requiring network neutrality. In this context, telephone communications which implement international roaming mechanisms and / or international inter-operator interconnection are particularly exposed to the risks of fraud and abuse, particularly in view of the technical complexity inherent in the establishment. such telephone communications, the multiplicity of actors (telephone operators, transit operators, etc.) involved and the diversity of the associated retail and wholesale pricing policies. What is more, in addition to the complexity of the technical and financial agreements that telephone operators operating separate telephone networks may conclude between themselves, there is the implementation of certain laws and regulations in terms of regulating the pricing of telephone communications (such as that, for example, the European regulations on roaming charges, known as “Roam Like at Home” (RLaH)). These are likely to create asymmetry phenomena between telephone operators, conducive to the development of fraudulent or abusive uses which can have a strong impact on telephone operators, both economically and technically.

Given the very large volume of daily telephone communications, the existence of fraud or abuse cannot be effectively detected without the implementation of specific detection methods and techniques designed to handle such quantities of telephone communications.

There are thus known methods and technical means, implemented in recent years by telephone operators, to detect customer subscriptions which are used fraudulently or abusively at the expense of the telephone operator. These known methods and means are typically provided for detecting fraud which consists, for third parties, in using the telephone subscriptions of a telephone operator to set up for their benefit a bypass of the legitimate routing (or termination) of telephone communications. As such, the known methods and means are typically designed to detect customer subscriptions of a telephone operator, involved in a fraudulent bypass scheme, by analyzing traffic data relating to telephone communications made by customers of the telephone line. operator and a comparison with well-defined typical profiles. Such known methods and means nevertheless have a certain number of major limitations and drawbacks. First of all, they generally do not make it possible to detect fraudulent or abusive uses of the telephony services of a telephone operator, which would be carried out using a telephone subscription from another telephone operator. In addition, they generally offer limited capacities in terms of the typology of fraud and abuse likely to be effectively detected through them, in particular due to the fact that they are essentially based on techniques for recognizing known typical profiles. However, fraudsters redouble their ingenuity to escape detection by such known detection methods and means by limiting their traffic volumes below detection thresholds or by creating unprecedented patterns of fraudulent or abusive use that are particularly penalizing for operators. telephone operators.

DISCLOSURE OF THE INVENTION

The objects assigned to the invention therefore aim to overcome all or part of the aforementioned drawbacks, and to propose a new technical method for detecting fraudulent or abusive uses of telephone services, which makes it possible to detect fraudulent uses in a particularly efficient manner. or abusive telephone services.

Another object of the invention aims to provide a new method for detecting fraudulent or abusive uses which cannot easily be the subject of counter-detection and avoidance by third party fraudsters or abusers.

Another object of the invention aims to provide a new method for detecting fraudulent or abusive uses, which is particularly reliable and robust, with a reduced risk of detecting false positives.

Another object of the invention aims to propose a new method for detecting fraudulent or abusive uses which, while being particularly effective, nevertheless remains particularly simple and quick to implement. The objects assigned to the invention are achieved using a method for detecting fraudulent or abusive use of at least one telephone service provided by a telephone operator, said method comprising the following successive steps:

a step E1 of collecting, by a first collection module, transaction data relating to a plurality of telephone calls made, over at least a portion of a given study period, from or to telephone numbers, called studied numbers, said plurality of telephone communications comprising at least telephone communications which involve a roaming and / or interconnection situation;

- a step E2 of computerized processing of said transaction data and construction, for each number studied, of an individual file compiling transaction data collected which corresponds to said number studied over said portion of a study period;

a step E3 of upgrading telephone communications from among said plurality of telephone communications, by a first upgrading module, on the basis of pre-established rules for upgrading wholesale costs, in order to obtain, for each of said numbers studied, an amount of wholesale costs incurred by the telephone operator over said portion of the study period; said method then comprising:

- a step E4 of identification, by a first identification module, of studied numbers called suspect numbers for which, over said portion of the study period, said amount of wholesale costs is greater than a first predetermined threshold value; and or

a step E5 of calculation by a calculation module, for each of said studied numbers or of said suspect numbers, of an amount of income generated for the benefit of the telephone operator over said portion of the study period, which step E5 is followed by a step E6 of identification, by a second identification module, of studied numbers or of suspect numbers for which, over said portion of the study period, said amount of wholesale costs is greater than said amount of income; said method comprising, after step E4 or after step E6, a step E7 of detecting fraudulent or abusive use by analysis, by an analysis module, of transaction data compiled in said individual files associated with said numbers identified and / or multiparametric indicators constructed from transaction data compiled in said individual files associated with said identified numbers.

BRIEF DESCRIPTION OF THE DRAWINGS

Other features and advantages of the invention will appear and emerge in greater detail on reading the description given below, with reference to the appended drawings, given solely by way of illustrative and non-limiting examples, among which: FIG. 1 schematically illustrates a variant of a detection method in accordance with the invention; FIG. 2 schematically illustrates another variant of a detection method according to the invention; FIG. 3 schematically illustrates yet another variant of a detection method according to the invention.

WAYS TO CARRY OUT THE INVENTION

The invention relates to a method for detecting fraudulent or abusive use of at least one telephone service provided by a telephone operator, or at the very least, for detecting an abnormal, unexpected use of such a service. telephone service, which is likely to cover fraud or abuse by a third party to said telephone operator. Thus, “fraudulent or abusive use” is here advantageously understood to mean a diverted, improper or unexpected use of at least one telephone service provided by the telephone operator, which use generally aims to generate financial gain, or at the very least a financial economy, for the benefit of a fraudster or an abuser. Such fraudulent or abusive use is likely to, if not intended to, negatively impact said telephone operator economically and / or technically. The telephony service (s) likely to be affected by the method in accordance with the invention may be, for example, technical services for making a number available to a customer (subscriber) of the telephone operator. telephone and a SIM card (for "Subscriber Identity Module"), as well as associated technical services to allow said customer in particular to access a telephone network operated by said telephone operator and to use said network to achieve telephone communications (sending / receiving "voice" calls, SMS / SMS + or MMS / MMS + type messages, data, etc.), in connection with a telephone subscription or with a pre- or post access offer -paid subscribed by said customer with said telephone operator. In addition, it may be telephony services allowing the customer of the telephone operator to perform, using a telephone number and a SIM card made available to him by the telephone operator , telephone communications when roaming on a telephone network of a third-party telephone operator.

Furthermore, said telephony services can also be, for example, technical services of "making available" to a third party telephony operator of a telephony network operated by said telephony operator, typically within the framework of roaming and / or interconnection agreements, as well as associated technical services to allow a customer of said third-party telephone operator to access a telephone network operated by said telephone operator and to use said network to carry out telephone communications (sending / receiving "voice" calls, SMS / SMS + or MMS / MMS + type messages, data, etc.) in a roaming and / or interconnection situation . In this case in fact, the customer of the third-party telephone operator, although not being a customer of said telephone operator and primarily using telephone services provided to him by the third-party telephone operator from which the customer has taken out a subscription or a post- / pre-paid offer, indirectly uses one or more telephony services of said telephone operator when, for example, said customer is welcomed while roaming on a telephone network of said telephone operator or when said customer makes a telephone call which is routed, terminated, via the telephone network of said telephone operator. The detection method according to the invention advantageously aims in particular to detect fraud or abuse which could typically be the result of:

- a customer of the telephone operator, who has subscribed to an offer of service (s) with the telephone operator, and who in this context uses at least one service of the telephone operator from a telephone number managed by the telephone operator and connected either directly to a telephone network of the telephone operator, or to a telephone network of a third-party telephone operator in a roaming situation; and or

- a customer of a third-party telephone operator, who uses at least one service of the telephone operator allowing him to connect to a telephone network of the latter (as a visited network) and to carry out telephone communications while roaming.

In particular, certain customers are likely to use a telephony service thus provided by the telephony operator for the sole purpose of taking advantage of advantageous financial conditions associated with a particular service offer (s), for example for certain countries of destination of calls, for certain formats of telephone communications, etc., in order to carry out fraudulent operations, or at the very least abusive, and for example for:

- exploit the resale of telephone communications traffic (setting up of "SIM box" systems for the resale of international telephone communications traffic in voice format or for the resale of telephone communications traffic in SMS format in Application-to-Person mode ( A2P), for example),

- generate traffic inflation (artificial traffic) of telephone communications to their advantage,

- call premium rate numbers with the aim of capturing a share of the termination costs associated with the telephone calls thus generated, etc.

They may also, for example, be natural person customers who, while not having the primary intention to defraud, nonetheless misuse a telephone service provided by the telephone operator with which they have subscribed to an offer. of service (s), sometimes despite the establishment by the telephone operator of rules of fair use, reasoned (or FUP, for "Fair Use Policy" in English).

The method according to the invention can typically be implemented by the telephone operator itself, or by a third party appointed for this purpose by said telephone operator. The implementation of such a detection method advantageously aims - once a fraud or an abuse has been detected using said method - to allow the implementation, if necessary, of corrective and / or preventive actions in a manner. strongly limit, if not totally prohibit, the continuation or reproduction of such fraudulent or abusive use. As will be considered below, the method according to the invention may optionally include one or more steps aimed at the implementation of such corrective and / or preventive actions.

In general, the detection method according to the invention, illustrated schematically in Figures 1 to 3, comprises a plurality of successive steps, including at least:

a step E3 of upgrading telephone communications from among said plurality of telephone communications, by a first upgrading module, on the basis of pre-established rules for upgrading wholesale costs, in order to obtain, for each of said numbers studied, an amount of wholesale costs incurred by the telephone operator over said portion of the study period. The process then comprises:

a step E5 of calculating, by a calculation module, for each of said studied numbers or of said suspect numbers, an amount of income generated for the benefit of the telephone operator over said portion of the study period, which step E5 is then followed by a step E6 of identification, by a second identification module, of studied numbers or of suspect numbers for which, over said portion of the study period, said amount of wholesale costs is greater than said amount of income.

In addition, the method in accordance with the invention also comprises, after step E4 or after step E6 depending on the alternative chosen, a step E7 of detecting fraudulent or abusive use by analysis, by a module of analysis of transaction data compiled in said individual records associated with said identified numbers and / or of multiparametric indicators constructed from transaction data compiled in said individual records associated with said identified numbers.

Thus, in a very unique way, the invention in particular implements the clever combination:

- technical operations for collecting and individualizing, by telephone number studied, transaction data characterizing telephone communications made using at least one telephone service provided by the telephone operator, and

- technical operations to revalue telephone communications, the transaction data of which was thus collected and individualized, and identification of telephone numbers presenting a particular economic anomaly. These operations aim to target the detection of fraud and abuse on telephone numbers studied which, given the existence of such an anomaly, present a very high probability of fraud or abuse.

According to a variant (referred to as variant A below), illustrated schematically in FIG. 1, the detection method according to the invention can therefore comprise the aforementioned steps E1, E2, E3, E4 and E7, steps E5 and E6 being omitted. In other words, fraud or abuse detection is then focused on phone numbers for which a wholesale cost anomaly has been identified. Such an approach is particularly relevant insofar as, whatever the modus operandi of the fraud and abuse in telephony, they are precisely likely to generate abnormally high wholesale costs for the telephony operator.

According to another variant (called variant B below), illustrated schematically in FIG. 2, the detection method according to the invention can comprise steps E1, E2, E3, E5, E6 and E7, step E4 therefore being omitted. The detection of fraud or abuse is then focused on telephone numbers for which an anomaly in terms of "gross margin" has been identified, that is to say on telephone numbers for which a negative difference between the numbers. revenue and wholesale costs has been identified. Such an approach is particularly advantageous insofar as, whatever the modus operandi of the fraud and abuse in telephony, the latter are likely to generate wholesale costs for a given telephone number which, although possibly not abnormally high as such, nonetheless remain higher than the income generated for the benefit of the operator for this same telephone number.

According to yet another variant (called variant C below), illustrated schematically in FIG. 3, the detection method according to the invention can comprise all of the steps E1 to E7 listed above. In this case, the studied numbers concerned by steps E5 and E6 are then advantageously telephone numbers which have been previously identified as suspects on a cost anomaly criterion at the end of step E4. Such a variant C of the method according to the invention therefore thus advantageously involves a cascade identification of economic anomalies in terms of costs and “gross margin”. The method according to the invention thus advantageously makes it possible to detect more quickly and more effectively known fraud or abuse, but also to detect particularly effectively fraud or abuse which hitherto remained undetectable using known detection methods, insofar as the latter:

- does not consider such a logic of individualization of telephone communications by number studied, and

- are absolutely not interested in the existence of economic anomalies (and moreover are absolutely not in a position, from a technical point of view, to detect such economic anomalies), which are nevertheless highly likely to sign the existence fraud or abuse in telephone communications.

It should also be noted that, due in particular to the fact that it implements a technical identification of anomalies of an economic nature, the method in accordance with the invention is particularly insensitive to the setting up, by fraudsters or abusers. , counter-detection and avoidance techniques.

The method according to the invention and the various steps introduced above in general will be described in more detail below.

As introduced above, step E1 of the method in accordance with the invention aims to extract, import, collect transaction data relating to telephone communications which are carried out over at least a portion of a (temporal) period of predefined study, from or to telephone numbers (studied numbers), therefore using at least one telephone service of said telephone operator.

Said portion of the given study period and its extent can be advantageously defined according to

- the quantity of telephone transaction data involved, and / or

- a typical duration of fraud or abuse that we prefer to detect: certain frauds can be carried out over very short time intervals, for example during a religious holiday or a sporting event generating a very significant telephone traffic, in which fraudsters can more easily conceal their operations, while other frauds may on the contrary be characterized by relatively long operating times, and / or

- a frequency of generation and availability of CDR, EDR and / or TAP files containing transaction data, and / or

- a frequency of the provision of the telephone service by the telephone operator, or according to any other relevant additional or alternative criteria.

Said study period may include a single study period portion, or a plurality of study period portions, consecutive or not, continuous or discontinuous. The study portion (s) may for example correspond to a particular time slot of a given day, a time slot extending over one or more days, over one or more weeks, etc. Optionally, it may be consecutive portions of the study period which are advantageously of the same duration. For example, the study period might be six months and consist of six consecutive study period portions, one month each.

In a manner known as such, said transaction data is data which characterizes telephone communications carried out, which required the implementation of a certain number of technical operations to allow their establishment, their routing. Typically, such transaction data can include a calling party telephone number (sender number), a called party telephone number (receiver number), time-stamping information for a telephone call, information relating to a country. origin (transmission) of a telephone communication, information relating to a destination country (reception) of a telephone communication, information relating to a number of telephone calls of a given format, information relating to a duration a telephone call, information relating to a volume of data exchanged during a telephone call, information relating to a roaming situation (country, date, etc.) of a calling or called telephone number, an I EI number (for "International Mobile Equipment Identity" in English), etc .;

In particular, the transaction data collected during Step E1 include at least transaction data relating to communications telephone calls involving a roaming and / or interconnection situation (or telephone communications with an exogenous component), i.e. transaction data relating to telephone communications which, involving roaming mechanisms and / or inter-operator interconnection, required for their establishment and implementation, the use of at least one telephone service provided by the telephone operator and at least one other telephone service supplied by a telephone operator. third-party telephony. Such telephone communications with an exogenous component generate, in a manner known as such, wholesale costs ("Wholesale" in English) for the telephone operator, which are billed to the latter by partners or technical service providers or even by one or more third-party telephony operators, within the framework of roaming agreements (inter-operator pricing agreements for roaming charges, or “Inter-Operator Tariff †” (“IOT”) in English) and / or interconnection (inter-operator pricing agreement for interconnection, termination, or transit charges).

More specifically, such transaction data relating to telephone communications with an exogenous component are likely to be generated in particular in the following situations:

- in the case of a telephone call made by at least one customer of the telephone operator, said client being connected to a telephone network (home network or "home network" in English) operated by the telephone operator, said telephone communication requiring the establishment of at least one interconnection to a telephone network of a third party telephone operator;

- in the case of a telephone communication carried out in a roaming situation, by at least one client of the telephone operator, said client being connected to a telephone network (visited network) of a third-party telephone operator (outbound roaming);

- in the case of a telephone call made in a roaming situation, by at least one customer of a third-party telephone operator, said customer being connected to a telephone network (home network or "home network" in English) of the telephone operator (inbound roaming or "inbound roaming"). As a reminder, roaming is the option offered to a customer of a telephone operator to be able to send and / or receive, from or to his telephone number, at least one telephone communication by the telephone. 'intermediary of a telephone network to which it is connected and which is operated by a third party telephone operator to the telephone operator of said customer. A situation of homelessness can exist both nationally and internationally. Also in a known manner, the interconnection relates to the connection between the telephony networks of a plurality of telephony operator (s) to allow a customer of one of these telephony operators to carry out a telephone call to destination. '' a telephone number managed by another telephone operator and connected to a third-party telephone network. An interconnection situation can exist at both national and international level.

Optionally, it can also be collected during step E1, transaction data relating to telephone communications with an endogenous component only, that is to say relating to telephone communications which have been carried out using exclusively one or more. several telephone services provided by the telephone operator and one or more telephone networks operated by said telephone operator (typically, telephone communications made between two clients of the telephone operator, both connected to a network of telephony from the telephone operator).

According to a variant, during step E1, all of the transaction data relating to the telephone calls made, during said portion of the study period, are collected by using at least one telephone service provided by the operator. of telephony.

However, depending on the length of the study period portion chosen, the volume of corresponding telephone transaction data may turn out to be extremely high, so that the collection and subsequent processing of the latter would be particularly long and complex and may require implementation of particularly costly technical means of collection and treatment. Thus, in particular to the extent that such telephone communications with an endogenous component only are usually not likely to generate wholesale costs for the telephone operator, it is advantageous to provide that the transaction data intended to be compiled in the records individual during step E2 are transaction data relating solely to telephone communications involving a roaming and / or interconnection situation (telephone communications with an exogenous component only).

As such, the detection method may comprise, according to a variant, an operation of selecting (or filtering) the transaction data collected during step E1, so as to rule out any transaction data relating to communications. telephone with endogenous component only which could have been collected, and thus to keep for the execution of the following steps of the method only transaction data relating to telephone communications involving a roaming and / or interconnection situation. According to another variant, it can be envisaged that said collection step E1 is designed to collect only such transaction data relating to a roaming and / or interconnection situation. For example, said first collection module could in this case be advantageously configured to collect, during said step E1, only such transaction data relating to a roaming and / or interconnection situation, among a larger set. of transaction data available.

Even more advantageously, the transaction data intended to be compiled in the individual files during step E2 are transaction data relating only to telephone communications involving a situation of international roaming and / or international interconnection. . Indeed, given their technical complexity of implementation and monitoring, the multiplicity of players involved and the diversity of associated pricing policies, telephone communications involving a situation of international roaming and / or international interconnection are more particularly exposed to the risks of fraud and significant abuse for the telephone operator. It thus turns out in practice to be particularly relevant and efficient to analyze more specifically such telephone communications with an international component. As such, said method may comprise, according to a variant, an operation of selecting (or filtering) the transaction data collected, so as to rule out any transaction data relating to telephone communications not involving a situation of international roaming and / or international interconnection, and thus to keep for the execution of the following steps of the process only transaction data relating to telephone communications involving a situation of international roaming and / or international interconnection . According to another variant, it can be envisaged that said collecting step E1 is designed to collect only such transaction data relating to a situation of international roaming and / or international interconnection. For example, said first collection module could in this case be advantageously configured to collect, during said step E1, only such transaction data relating to an international roaming and / or international interconnection situation, from among a set largest transaction data available.

In this particular scenario, the transaction data which will then be processed during step E2 therefore advantageously belong to one or the other of the following three groups:

- telephone transaction data relating to at least one international telephone call made, by at least one customer of the telephone operator, from a telephone network operated by the telephone operator and to which said client is connected, and involving the establishment of at least one international interconnection. It can therefore in particular be transaction data which characterizes at least one telephone call sent by at least one customer of the telephone operator from at least one telephone number managed by said telephone operator, from a network. telephone (or home network) of the latter to which the customer is connected, and to at least one telephone number managed by a foreign third-party telephone operator (that is to say not operating in the same country as said telephone operator) and reachable through a foreign third-party telephone network from said foreign third-party telephone operator;

- telephone transaction data relating to at least one telephone call made while roaming abroad, by at least one customer of the telephone operator, by using a foreign third-party telephone network operated by a foreign third-party telephone operator and to which said customer is connected. It can therefore in particular be telephone transaction data which characterizes at least one telephone call sent (or received) by at least one customer of the telephone operator from (or to) at least one telephone number managed by the telephone. telephone operator, said customer being in a situation of roaming abroad so that said telephone call is sent from (or received on a) foreign third-party telephone network (network visited while roaming, "visited network" in English) operated by a foreign third-party telephone operator (so-called outgoing roaming telephone call);

- telephone transaction data relating to at least one telephone call made in a roaming situation, by at least one customer of a foreign third-party telephone operator, using a telephone network operated by the telephone operator and to which is connected said client. It can therefore in particular be transaction data which characterizes at least one telephone call sent (or received) by at least one customer of a foreign third-party telephone operator from (or to) at least one telephone number managed by said telephone. foreign third-party telephone operator, said client being connected in a roaming situation to a telephone network (visited network) of the telephone operator, from which is sent (on which is received) said communication telephone.

However, depending on the nature of the telephone service (s) provided by the telephone operator and / or depending on the fraudulent or abusive uses that one seeks preferentially to detect, it is also possible to envisage providing that the transaction data intended for be compiled in said individual files during step E2 are transaction data relating solely to telephone communications involving a roaming situation, whether the latter is national or international, and / or an international interconnection situation. It is also not excluded that it is possible to provide that the transaction data intended to be compiled during step E2 are transaction data relating only to telephone communications involving an international roaming situation and / or an interconnection situation, whether the latter is national or international. Advantageously, said transaction data collected during step E1 are contained in detailed call recording files (called CDR files, for “Call Detail Record” and / or EDR files for “Event Detail Record”), and / or in transaction files relating to a roaming situation in TAP format (for “Transferred Account Procedures”, said TAP format can be of any known version, and for example of version TAP1, TAP2, TAP2 + or even TAP3. They can be so-called “TAP IN” files or “TAP OUT” files, depending on whether they concern incoming or outgoing roaming situations). Such CDR / EDR and TAP files, which are generated by the various players and technical equipment involved in establishing and carrying out telephone calls for billing purposes, are well known as such and are subject to international standards. telecommunications industry, so it is not necessary to describe them in more detail here.

The first collection module implemented for carrying out step E1 can thus be configured to read, extract and collect transaction data contained in detailed call recording files (called CDR files and / or EDR files. ), and / or in files of transactions carried out while roaming (known as TAP IN and / or TAP OUT files). Alternatively, said first collection module can be configured to collect said detailed call recording files and / or said transaction files relating to a roaming situation in TAP format, as such, and then extract the data. of transactions that these files contain.

Advantageously, said transaction data intended to be compiled in said individual files during step E2 relate to telephone communications in voice format, in SMS and / or SMS + and / or MMS and / or MMS format (s). or MMS +, and / or in Data format. In other words, depending on the nature of the telephone service (s) provided by the telephone operator and / or depending on the fraudulent or abusive uses that it is preferentially sought to detect, said transaction data collected may be limited to transaction data. relating only to voice-format telephone communications, relating only to message-type telephone communications in SMS (“Short Message Service”), SMS + (“premium Short Message Service”), MMS (“Multimedia”) format (s) Message Service ") and / or MMS + (" premium Multimedia Message Service "), relating to only to telephone communications in Data format, or else relating to telephone communications in several different formats among those listed above. For example, said transaction data compiled in the individual files during step E2 may only concern telephone communications in voice format on the one hand and telephone communications in SMS / SMS + / MMS / MMS + format on the other hand. .

As such, the detection method may optionally include an operation of selecting (or filtering) the transaction data collected during step 1 in order to keep, with a view to carrying out the following steps of said method, only data from the transactions. transactions relating to telephone communications in the format (s) chosen from the aforementioned Voice, SMS / SMS + / MMS / MMS + and Data formats. Alternatively, step E1 could be carried out so as to collect during the latter only transaction data relating to telephone communications in the format (s) chosen from among the Voice, SMS / SMS + / formats. MMS / MMS + and Data mentioned above.

Typically, in the case where the method according to the invention is implemented by a third party appointed by the telephone operator, as envisaged above, the collection step E1 can implement the establishment of a remote computer connection, for example via the Internet, to one or more databases of said telephone operator, and downloading by said first collection module, advantageously implemented within an IT infrastructure of the mandated third party actor, transaction data contained in said database (s) of said telephone operator.

The transaction data thus collected during step 1 and / or selected after collection, are advantageously stored in at least one database. In order in particular to facilitate the handling and processing of said transaction data, said database in question is preferably managed by a document-oriented database management system, possibly distributable over any number of computers and advantageously not requiring predefined data schema (such as for example a MongoDB® database). What is more, step E1 which has just been described may possibly include a certain number of additional technical operations aimed at improving its efficiency, speed and / or reliability, such as for example:

- one or more validation operations (number, redundancy, integrity, etc.), by at least one validation module, of transaction data collected and / or selected after collection, and / or

- one or more reprocessing operations, by at least one reprocessing module, of transaction data collected and / or selected after collection, and / or CDR, EDR and / or TAP files (TAP IN and / or TAP OUT) in which said transaction data may be contained, including for example, a conversion to national / international format of telephone numbers, an aggregation of transaction data relating to a plurality of different formats of telephone communications (voice, SMS / SMS + / MMS formats / MMS +, Data, etc.), possibly over different sub-periods and / or coming from a plurality of sources (databases, etc.) of transaction data.

During step E2 introduced above, transaction data collected during step 1 and / or selected after collection during step 1, are then processed in a computerized manner, and advantageously automated, and an individual file (or matrix) is constructed for each of said numbers studied. Advantageously also computerized, each of said individual records compiles, aggregates, collected transaction data corresponding to a number studied over the study period, so as to advantageously constitute an individual summary record of use.

Said step E2 can advantageously be implemented using a data compilation / aggregation module and a module for building individual files, connected to said data compilation / aggregation module. Advantageously, the method can comprise an operation of storing the individual files thus constructed, for example in a database of individual files or in the form of as many distinct computer files. Step E3 of the detection method according to the invention then aims to obtain and calculate, for each of said numbers studied (and therefore for each of said associated individual files) an amount of wholesale costs borne by the operator on the portion considered. period of study or, at the very least, a score or indicator representative of such amount of wholesale costs. The term “revaluation of telephone communications” is therefore understood here to mean the calculation of an amount (or of a note or indicator representative of an amount) of wholesale costs borne (or at the very least likely to be borne) by the operator over at least said portion of the study period, for establishing and carrying out telephone calls for which the corresponding transaction data has been collected, optionally selected, then compiled, aggregated, in an individual file associated with a number studied given.

To do this, the telephone communications corresponding to the transaction data collected, possibly selected, then compiled, aggregated, in each of the individual files are revalued, advantageously automatically, by said first revaluation module, on the basis of pre-established revaluation rules wholesale costs. Said first revaluation module can in this respect be connected, for example, on the one hand to at least one database in which said pre-established rules for revaluation of wholesale costs are stored and, on the other hand, to the database. data in which said individual records are advantageously stored. At the end of step E3, an amount (or a note or an amount indicator) of wholesale costs is thus assigned to each of said numbers studied, and therefore to each of the corresponding individual files. Advantageously, each telephone call is upgraded individually during step E3, so as to obtain a corresponding wholesale cost per telephone call, then the total amount of wholesale cost per number studied is obtained by summing the wholesale costs of each of the telephone calls made by said number studied. Optionally, said amount (or said note or said amount indicator) of wholesale costs can then be reported in the corresponding individual file. It is also possible to provide that, in addition to said total amount of wholesale costs thus calculated, the wholesale costs calculated individually for each of the telephone calls are also reported in the corresponding individual file. Preferably, said pre-established rules for revaluing wholesale costs are based in whole or in part, and more preferably exclusively, on estimated wholesale prices. Indeed, given in particular the multiplicity of potentially applicable wholesale tariff agreements (and therefore of different tariff documents and / or databases that should be taken into consideration), their high variability depending on multiple criteria (such as for example the origin and / or destination networks of communications, the transit operator (s) involved, the billing rate considered, or even according to changes in currency exchange rates), and their often character very confidential, it can sometimes prove difficult to construct and apply rules for revaluing wholesale costs which are exclusively based on actual wholesale prices. Thus, the implementation of estimates for the construction of pre-established rules for revaluing wholesale costs advantageously makes it possible to considerably simplify and accelerate the implementation of the method. Even more advantageously, said pre-established rules for revaluation of wholesale costs are based in whole or in part on estimated wholesale tariffs, to which an increasing safety coefficient is applied, so that the amount thus calculated of wholesale costs borne by the telephone operator over said portion of the study period is deliberately overestimated.

Once an amount of wholesale costs has been obtained at the end of step E3 for each of said numbers studied, step E4 of the detection method in accordance with the invention then aims to identify, among said numbers studied, the one or those for which (s) said corresponding amount of wholesale costs is greater than a first predetermined threshold value (predetermined threshold value of costs). The numbers studied thus identified are thus qualified as suspects. Advantageously, said first identification module is therefore configured to automatically compare one by one the amounts (or notes or amount indicators) of wholesale costs obtained at the end of step E3 with said first predetermined threshold value.

Said first predetermined threshold value is advantageously defined as being representative of an amount of wholesale costs (or of a rating or indicator value representative of an amount of wholesale costs) that the telephone operator considers likely usually support, in connection with the telephony service (s) it provides, over said portion of the study period. By way of nonlimiting example, said first predetermined threshold value may be chosen according to an average turnover per customer (or ARPU, for "Average Revenue Per User" in English) generated in the past for a period comparable to said portion of the study period considered . The individual files which correspond to studied numbers thus identified as suspect at the end of step E4 can then, for example, be extracted and stored in a database of suspicious individual files, or even be assigned an identifier. or particular marker.

Following or instead of said step E4 (depending on the variant B or C selected), the detection method comprises a step E5 which, as already introduced above, implements a calculation module to calculate, for each of said numbers studied or for each of said numbers identified as suspect at the end of step E4, an amount of revenue generated (or likely to be generated) for the benefit of the telephone operator over said portion of the study period or, at the very least, a score or indicator representative of such amount of income.

Typically, said revenues generated for the benefit of the telephone operator can be:

- retail income (or "retail" in English), which the telephone operator is likely to receive by invoicing its own customers for the telephone calls sent (and sometimes for certain telephone calls received) by the latter; and or

- wholesale revenues that the telephone operator is likely to receive by re-invoicing third-party operators for at least one of its telephone services under roaming agreements (agreements inter-operator pricing for roaming charges, or “Inter-Operator Tariff” (“IOT”) and / or interconnection (inter-operator pricing agreement for interconnection, termination, or transit).

Indeed, telephone communications sent by a telephone number of a customer of the telephone operator are likely to generate retail revenues for the latter. In addition, telephone communications received by a telephone number of a customer of the operator are likely to generate for the benefit of this last of wholesale revenues, in particular when these communications were made by a customer of a third-party telephone operator (invoicing of interconnection charges for termination). In addition, certain telephone communications sent or received by a telephone number of a customer of a third-party telephone operator are likely to generate wholesale income for the telephone operator, in particular in the case of telephone calls sent or received. when roaming on a telephone network of said telephone operator.

Thus, step E5 can advantageously comprise an operation for calculating, by said calculation module, an amount of retail income from retail billing data derived from actual invoices established by said telephone operator. To do this, the detection method can then include an operation of collecting actual retail billing data, corresponding to the portion of the study period considered, and associated with those of said numbers studied or suspect numbers which are actually managed by the telephone operator, that is to say which are used by customers of the latter. Such a retail billing data collection operation can for example be performed using a second collection module, which can be configured to remotely read, retrieve and collect actual retail billing data contained for example in one or more databases of the telephone operator, after establishment of a remote computer connection with said database or databases. Alternatively, said second collection module could be configured to remotely collect actual invoices in electronic format containing said actual retail invoicing data, then to extract from these invoices the only relevant real retail invoicing data, for example to the using a parsing process. Said invoices could be stored in one or more databases of the telephone operator, and thus be collected, imported, by the second collection module after establishing a remote computer connection with said database or databases.

Alternatively or in addition, step E5 may include an operation for revaluing telephone calls from among said plurality of telephone calls, by a second revaluation module, on the basis of pre-established rules for revaluing retail income and / or income. wholesale. As such, the second revaluation module can be connected, for example, on the one hand to at least one database in which said pre-established rules for revaluing retail income and / or wholesale income are stored and, d on the other hand, to the database in which said individual records are advantageously stored.

Such a revaluation of telephone communications on the basis of pre-established retail income revaluation rules can advantageously constitute an alternative or a complement to the operation of calculating, described above, an amount of retail revenue from data. retail billing from actual invoices issued by said telephone operator, in particular in the event that all or part of said actual retail billing data is not available. Said pre-established retail revenue revaluation rules may be based on actual retail tariffs, in accordance with a retail tariff plan collected from the telephone operator or publicly available, and / or in whole or in part on retail tariffs. estimated.

With regard to wholesale income, the pre-established rules for revaluing wholesale income are advantageously based in whole or in part, and preferably still exclusively, on estimated wholesale tariffs. Indeed, taking into account in particular the multiplicity of potentially applicable wholesale pricing (and therefore of different pricing documents and / or databases that should be taken into consideration), their high variability over time, and their nature. often very confidential, it can sometimes prove difficult to construct and apply rules for revaluing wholesale revenues which are exclusively based on actual wholesale rates. Thus, the implementation of estimates for the construction of pre-established rules for revaluing wholesale revenues makes it possible to make the process more reliable, to simplify it and to accelerate its implementation. Even more advantageously, said pre-established rules for revaluing wholesale income are based in whole or in part on estimated wholesale tariffs and to which a lowering safety coefficient is applied, so that the amount thus calculated of wholesale income including l The telephone operator is beneficiary over said portion of the study period is intentionally undervalued. At the end of step E5, an amount (or a note or an amount indicator) of income (retail and / or wholesale) is thus assigned to each of said numbers studied, or only to each of the numbers identified as suspects at the end of step E4 Advantageously, said calculation module can be configured to calculate during step E5 an amount of income per analyzed telephone call, then to calculate a total amount of income generated for the benefit of the person. telephone operator by summing the revenues calculated by telephone communication. Optionally, said amount (or note or indicator of amount) of income can then be reported in the corresponding individual file. It is also possible to provide that, in addition to said total amount of income thus calculated, the income calculated for each of the telephone calls concerned is also reported in the corresponding individual file.

As introduced previously, said step E5 is followed, in the case of variants B and C of the method according to the invention, by a step E6 of identification, by a second identification module, of studied numbers or of suspect numbers ( or at the very least of at least one studied / suspect number) for which, over said portion of the study period, said amount of wholesale costs obtained at the end of step E3 is greater than said amount of income ( details and / or wholesale) calculated during step E5. The numbers thus identified at the end of step E6 therefore constitute numbers which are also said to be suspect. Advantageously, said second identification module is therefore configured to automatically compare, for each of said studied numbers or suspect numbers, the amount (or note or indicator of amount) of wholesale costs obtained at the end of step E3 with the amount (or note or indicator of amount) of income calculated during step E5.

To reduce a possible risk of detection of false positives during step E7, it may be advantageous to provide that step E6 is, more precisely, a step of identifying studied numbers or suspect numbers (or to at the very least of at least one studied / suspect number) for which, over said portion of the study period, said amount of wholesale costs is greater than said amount of income by a value which exceeds a second predetermined threshold value. Advantageously, said second identification module can then be configured as such to automatically compare, for each of said studied numbers or suspect numbers, a difference between the amount of revenue and the amount of wholesale costs on the one hand and said second predetermined threshold value on the other hand.

Said second predetermined threshold value is advantageously defined as being representative of an amount of individual "gross margin" (or of a score value or of an indicator representative of an amount of individual "gross margin") that the operator de telephony considers that it is able to obtain, in connection with the telephony service (s) it provides, over the said portion of the study period.

The individual files which correspond to numbers thus identified as suspect at the end of step E6 can then, for example, be extracted and stored in a database of suspect individual files, or else be assigned an identifier or particular marker.

In order to further improve the efficiency of the detection method, the latter can advantageously comprise, at the end of step E4 and / or of step E6 (depending on variant A, B or C chosen), and advantageously before step E7:

- an operation to modify said pre-established rules for revaluation of wholesale costs, then

at least one new iteration of said steps E3 and E4, and / or said steps E3 and E6, on the basis of wholesale cost revaluation rules thus modified.

The implementation of such an additional technical characteristic may prove to be particularly relevant in the case in particular where, as envisaged above, said pre-established rules for revaluation of wholesale costs are based in whole or in part (or even exclusively) on estimated wholesale tariffs, with the possible application of an increased safety coefficient. Indeed, it could possibly happen that, depending on the degree of precision of the estimates used, an abnormally low or, on the contrary, abnormally high number of telephone numbers are identified, without this being therefore directly linked to the existence of a fraud or abuse. Like the initial wholesale cost revaluation rules, said amended wholesale cost revaluation rules may themselves be based in whole or in part on estimated wholesale rates. In addition or alternatively, and always with a view to improving the efficiency of the detection, the detection method can advantageously comprise, at the end of step E4, and advantageously before step E7:

- an operation for modifying said first predetermined threshold value, then

- at least one new iteration of step E4, on the basis of said first predetermined threshold value thus modified.

Symmetrically, in the case of variants B and C of the detection method according to the invention, the latter can advantageously comprise at the end of step E6, and advantageously before step E7:

- an operation to modify said pre-established rules for revaluing retail income and / or wholesale income, then

at least one new iteration of said steps E5 and E6, on the basis of predefined rules for revaluing retail income and / or wholesale income thus modified.

The implementation of such an additional technical characteristic may prove to be particularly relevant in the case in particular where, as envisaged above, said pre-established rules for revaluing retail income and / or wholesale income are based in whole or in part (or even exclusively) on retail tariffs and / or estimated wholesale tariffs, with the possible application of a lower safety coefficient. Indeed, it could possibly happen that, depending on the degree of precision of the estimates adopted, an abnormally low or, on the contrary, abnormally high number of telephone numbers are identified at the end of step E6, without this therefore being directly linked to the existence of fraud or abuse. Just like the initial retail and / or wholesale revenue revaluation rules, the modified retail and / or wholesale revenue revaluation rules may themselves be based in whole or in part on retail tariffs. and / or on estimated wholesale rates.

In addition or alternatively, and always with a view to improving the efficiency of the detection, the detection method can advantageously comprise, at the end of step E4, and advantageously before step E7: - an operation for modifying said second predetermined threshold value, then

- at least one new iteration of step E6, on the basis of said second predetermined threshold value thus modified.

Moreover, in a complementary or alternative manner to the above, it is advantageous to provide, for each of the numbers identified as suspect at the end of step E4 or at the end of step E6, a technical operation of validation of the corresponding wholesale cost amount obtained at the end of step E3 on the basis of actual wholesale prices, in the event that the pre-established rules for revaluation of wholesale costs (modified or not) are based in full or part on estimated wholesale rates. Such a validation operation can be carried out by upgrading, for example using the first upgrading module, telephone calls for which transaction data has been collected and compiled in the individual files corresponding to said suspect numbers. Thus, if the use of estimated wholesale tariffs for carrying out step E3 can advantageously make it possible to simplify and accelerate the implementation of the method when a large number of numbers studied and corresponding individual files is concerned, such a subsequent technical operation of validation of the amount of wholesale costs obtained at the end of step E3, for the numbers identified as suspect at the end of step E4 or of step E6 only (and therefore on a limited quantity of numbers studied), contributes to making the detection process even more reliable.

As already specified previously, said given study period may comprise a single and unique portion of the study period, or preferably, a plurality of portions of the study period, consecutive or not, continuous or discontinuous. Optionally, it may be consecutive portions of the study period which are advantageously of the same duration. For example, the study period might be six months and consist of six consecutive study period portions, one month each.

In this case, it is in particular advantageously possible to facilitate the implementation of the detection method and to further refine the detection of fraud or abuse by providing that: - step E4 is more specifically provided for identifying studied numbers called suspect numbers for which, over a plurality of portions of said study period, said amount of wholesale costs is greater than said first predetermined threshold value; and / or that

- step E6 is more specifically designed to identify numbers studied, or numbers already pre-identified as suspect at the end of step E4, for which o over a plurality of portions of said study period , said amount of wholesale costs is greater than said amount of revenue, or where applicable o over a plurality of portions of said study period, said amount of wholesale costs is greater than said amount of revenue by a value that exceeds one second predetermined threshold value, as previously considered.

Obviously, steps E3 and / or E5 (depending on the variant A, B or C selected) will then be adapted accordingly, so as to allow a revaluation of wholesale costs and / or a calculation of income (retail and / or wholesale) on each of the portions of such a plurality of study period portions.

Such an approach over a plurality of study period portions thus advantageously amounts to taking an interest in a chronic, repetitive nature of the anomalies detected, which further increases the probability of the existence of a fraud. or abuse associated with a given phone number. Step E7 can then be advantageously carried out once the preceding steps have been carried out over the whole of the given study period, that is to say so as to cover all the portions of said plurality of period portions. study.

Once the telephone numbers have been identified as suspect at the end of step E4 and / or step E6 (depending on the variant A, B or C selected) by detection of an economic anomaly in terms of wholesale costs and / or “gross margin”, said suspect numbers and their corresponding individual files are then submitted to step E7 of the detection method. As introduced previously, said step E7 has as its object the detection of at least one fraudulent or abusive use of at least one telephone service provided by the telephone operator by analyzing transaction data which has been compiled, during step E2, in said individual files associated with those from among said studied numbers which have been identified as suspects at the end of step E4 and / or of step E6. In a complementary or alternative manner, the detection of at least one fraudulent or abusive use of at least one telephone service provided by the telephone operator by analysis of multiparametric indicators constructed from transaction data which have been compiled, during step E2, in said individual files associated with the studied numbers which have been identified as suspects at the end of step E4 and / or of step E6.

As such, the method can then advantageously comprise an operation of constructing multiparametric indicators, for each of said individual files, on the basis of predefined construction rules. Such multiparametric indicators can advantageously be constructed during, or simultaneously with, step E2 of construction of the individual files. Optionally, said multiparametric indicators can be constructed for study sub-periods of a duration less than the respective duration of the study period portion (s) (for example per day, or even per week). Advantageously, said multiparametric indicators thus constructed can be stored in said individual files.

By way of non-limiting examples, such multiparametric indicators can be defined to describe, over one or more portions of the given study period or over a particular relevant sub-period of said study period:

- a number of different countries visited while roaming;

- a number of consecutive days in a roaming situation;

- a temporal frequency of transmission and / or reception of telephone communications of a given format;

- a number of different IMEI numbers used by the same telephone number; - a number of telephone calls in the SMS / SMS + / MMS / MMS + format (s) sent to one or more particular destination countries (and in particular to one or more particularly expensive destination countries), etc.

Particularly advantageously, all or part of said multiparametric indicators may be multiparametric indicators upgraded in terms of wholesale cost (interconnection costs and / or "IOT" costs), that is to say multiparametric indicators for which a a corresponding wholesale cost (actual or estimated) has been calculated. Such a revaluation could advantageously be carried out during, or simultaneously with, the revaluation step E3. It can be advantageously implemented using the first revaluation module, and on the basis of said pre-established rules for revaluing wholesale costs. Step E3 of the method may thus advantageously comprise a technical operation for revaluing multiparametric indicators constructed during step E2, on the basis of said pre-established rules for revaluing wholesale costs, in order to obtain for all or part of said d '' multiparametric indicators an amount of wholesale costs (interconnection costs and / or "IOT" costs) borne by the telephone operator over one or more portions of the given study period or over a particular relevant sub-period of said given study period.

Following the same logic, all or part of said multiparametric indicators may be multiparametric indicators revalued in terms of income (wholesale and / or details).

For reasons similar to those already explained above, the construction and then the analysis, during step E7, of such upgraded multiparametric indicators, which thus advantageously combine particular technical characteristics and an economic characteristic (costs and / or income) of telephone communications, makes it possible to further improve the efficiency of the detection of fraud or abuse.

Preferably, step E7 comprises an operation of grouping and / or statistical classification by profiles of the numbers identified at the end of step E4 and / or of step E6. Such a grouping and / or statistical classification operation may be advantageously carried out using a grouping and / or statistical classification module, which for example implements one or more classifier (s). Step E7 can then advantageously then comprise an operation of matching said profiles with at least one predefined proven fraudulent or abusive pattern, so as to confirm a fraudulent or abusive nature of said profiles. Defined prior to performing step E7, the predefined proven fraudulent or abusive pattern (s) can typically be stored in a database of known abusive or fraudulent pattern (s), which database can then be queried during said matching operation.

Alternatively or in addition, step E7 can advantageously comprise an operation to define one or more new fraudulent or abusive reason (s), in the particular case where one or more of said profiles do not correspond. for no predefined proven abusive or fraudulent motives. In this case, the method according to the invention may advantageously comprise an operation of memorizing said new fraudulent or abusive motive (s) in a database, which may then advantageously be the database of abusive motives or fraudulent known evoked above. Thus, this or these new fraudulent or abusive reason (s) can be used during a future new iteration of step E7, and in particular of the matching operation described above.

Advantageously, said method may comprise, at the end of said step E7, an operation of generating an alert, by an alert generation module, relating to the detection of at least one abusive or fraudulent use of at least one minus a telephone service provided by the telephone operator. Preferably automated, said alert generation operation may thus advantageously comprise the preparation and transmission of an alert report or electronic message (for example, an email), containing at least one identified telephone number. at the end of step E7 as having been involved (or at least as being very strongly suspected of having been involved) in a fraudulent or abusive use of at least one of said telephone services of the operator of telephony. Optionally, the individual file associated with said telephone number may be included in said report or electronic alert message, with a view to a possible additional analysis operation. Alternatively, the alert generated may take the form, for example, of specific information reported and displayed on a computerized dashboard.

Alternatively or in addition, said method may advantageously comprise at the end of said step E7, and for example after receipt of an alert generated during an alert generation operation as envisaged above:

- a disconnection operation (temporary or permanent) from a telephone number, and / or deactivation of a SIM card associated with a telephone number, for which fraudulent or abusive use of at least one of said telephone services of the telephone operator has been detected at the end of step E7, and / or

- an operation for modifying at least one operating parameter of a telephony service of said telephony operator whose abusive or fraudulent use by at least one telephone number has been detected at the end of step E7.

For example and in a nonlimiting manner, such an operating parameter can be:

- a maximum authorized volume of communication minutes in Voice format, per call or per reference period (for example per month in the case of a monthly telephone subscription), and / or for one or more countries or geographical areas of 'outgoing and / or incoming calls;

- a maximum volume of communications in the SMS / SMS + / MMS / MMS format (s) per reference period, and / or for one or more countries or geographic areas of outgoing and / or incoming calls;

- a maximum volume of data downloaded and / or uploaded in the context of telephone communications in Data format per reference period;

- a maximum downlink or amount of data likely to be downloaded or uploaded as part of telephone communications in Data format during a reference period, etc.

Such a modification of the operating parameter (s) may affect in an indiscriminate manner all telephone numbers using the relevant telephone service of the telephone operator or, on the contrary, only concern one or more telephone numbers. telephone for which fraudulent or abusive use of said telephony service concerned has been detected at the end of step E7.

POSSIBILITY OF INDUSTRIAL APPLICATION

The invention finds its application in the field of methods of detecting fraudulent or abusive use of telephony services provided by a telephony operator, and this in the particular case of telephone communications involving a roaming and / or roaming situation. interconnection of telephone networks.

Claims

1. Method for detecting fraudulent or abusive use of at least one telephone service provided by a telephone operator, said method comprising the following successive steps:

a step E5 of calculation by a calculation module, for each of said studied numbers or of said suspect numbers, of an amount of income generated for the benefit of the telephone operator over said portion of the study period, which step E5 is followed by a step E6 of identification, by a second identification module, of studied numbers or of suspect numbers for which, on said portion of study period, said amount of wholesale costs is greater than said amount of revenue; said method comprising, after step E4 or after step E6, a step E7 of detecting fraudulent or abusive use by analysis, by an analysis module, of transaction data compiled in said individual files associated with said numbers identified and / or multiparametric indicators constructed from transaction data compiled in said individual files associated with said identified numbers.

2. Method according to the preceding claim, wherein said transaction data are contained in detailed call recording files, called CDR and / or EDR files, and / or in transaction files relating to a roaming situation. in TAP format.

3. Method according to any one of the preceding claims, in which the transaction data intended to be compiled in said individual files during step E2 relate to telephone communications in voice format, in the format (s). ) SMS and / or SMS + and / or MMS and / or MMS +, and / or in Data format.

4. Method according to any one of the preceding claims, in which the transaction data intended to be compiled in said individual records during step E2 are transaction data relating only to telephone communications involving a roaming situation. and / or interconnection.

5. Method according to the preceding claim, in which the transaction data intended to be compiled in said individual files during step E2 are transaction data relating only to telephone communications involving an international roaming situation and / or international interconnection.

6. Method according to any one of the preceding claims, wherein said pre-established wholesale cost revaluation rules are based in whole or in part on estimated wholesale tariffs.

7. Method according to any one of the preceding claims, which comprises, at the end of step E4 and / or of step E6, an operation for modifying said pre-established rules for revaluation of wholesale costs, then at least a new iteration of said steps E3 and E4, or of said steps E3 and E6.

8. Method according to any one of the preceding claims, which comprises, at the end of step E4, an operation for modifying said first predetermined threshold value, then at least one new iteration of step E4.

9. Method according to any one of the preceding claims, wherein step E6 is a step of identifying studied numbers or suspect numbers for which, over said portion of the study period, said amount of wholesale costs is. greater than said amount of income by a value that exceeds a second predetermined threshold value.

10. Method according to the preceding claim, which comprises, at the end of step E6, an operation for modifying said second predetermined threshold value, then at least one new iteration of step E6.

11. Method according to any one of the preceding claims, in which step E5 comprises an operation of revalorizing telephone communications from among said plurality of telephone communications, by a second revaluation module, on the basis of pre-established income revaluation rules. retail and / or wholesale revenue.

12. Method according to the preceding claim, in which said pre-established revenue revaluation rules are based in whole or in part on estimated retail tariffs and / or estimated wholesale tariffs.

13. Method according to any one of claims 11 and 12, which comprises, at the end of step E6, an operation for modifying said pre-established rules for revaluing retail income and / or wholesale income, then at the end of step E6. minus a new iteration of said steps E5 and E6.

14. Method according to any one of the preceding claims, in which step E5 comprises an operation of calculating, by said calculation module, an amount of retail income from retail invoicing data obtained from actual invoices. established by said telephone operator.

15. Method according to any one of the preceding claims, wherein said step E7 comprises:

- an operation of grouping and / or statistical classification by profile of the numbers identified at the end of step E4 and / or step E6, and

- an operation to match said profiles with at least one predefined proven abusive or fraudulent reason or an operation to define a new abusive or fraudulent reason.

16. Method according to any one of the preceding claims, which comprises at the end of said step E7, an operation of generating an alert, by an alert generation module, relating to the detection of an abusive use. or fraudulent.

17. Method according to any one of the preceding claims, which comprises: - an operation of disconnecting a telephone number or deactivating a SIM card associated with a telephone number, for which fraudulent or abusive use of at least one of said telephony services of the telephony operator has been detected at the end of step E7; and or