GB2366699A - Detecting changes in a customer's behaviour profile - Google Patents
Detecting changes in a customer's behaviour profile Download PDFInfo
- Publication number
- GB2366699A GB2366699A GB0021511A GB0021511A GB2366699A GB 2366699 A GB2366699 A GB 2366699A GB 0021511 A GB0021511 A GB 0021511A GB 0021511 A GB0021511 A GB 0021511A GB 2366699 A GB2366699 A GB 2366699A
- Authority
- GB
- United Kingdom
- Prior art keywords
- behaviour
- customer
- transition
- pattern
- patterns
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/12—Detection or prevention of fraud
- H04W12/126—Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04M—TELEPHONIC COMMUNICATION
- H04M2203/00—Aspects of automatic or semi-automatic exchanges
- H04M2203/60—Aspects of automatic or semi-automatic exchanges related to security aspects in telephonic communication systems
- H04M2203/6027—Fraud preventions
Abstract
Apparatus and methods for monitoring the behaviour of variable-behaviour units, such as for monitoring human behaviour, are described. In one particular example, the behaviour of customers to a wireless telephone network is monitored. For each customer a predetermined behaviour profile, or behaviour region within a total 'customer behaviour space', is stored in a customer profile store (20). Calls made by customer in the network (12) are fed to a call analyser (14) which also receives inputs from a profile definition store (16) storing the definitions of different possible behaviour patterns or behaviour regions. Over a period of time, the current behaviour profile of a particular customer is determined and output to a transition detector (18) where it is compared with the pre-stored customer behaviour profile. The transition detector (18) detects any transition between the customer's current behaviour profile and the pre-stored profile, and any such detected transition is passed to a transition processor (22). This operates under control of a transition rule store (24) which stores data indicating which particular transitions are acceptable and which are not. Any that are not acceptable cause an alert to be produced by an alarm processor (26). In addition, an adaptation system (28) responds to the data from the call analyser (14), the transition detector (18), and the transition processor (22) to carry out adaptations of the data in the profile definition store (16), the customer profile store (20) and the transition rule store (24).
Description
2366699 APPARATUS AND METHODS FOR BEHAVIOUR PROFILING The invention
relates to apparatus and methods for behaviour profiling. Apparatus and methods according to the invention, and to be described in more detail below by way of example only, are for monitoring the behaviour of customers in a telecommunication network, such as a cellular telephone network, However, they may be used in many other applications.
According to the invention, there is provided apparatus for classifying and monitoring the behaviour of each of a plurality of variable-behaviour units, comprising a data store for storing data representing definitions of a plurality of different predetermined patterns of behaviour, means for classifying each of the units into one of the predetermined patterns of behaviour according to the previously determined behaviour of that unit, behaviour monitoring means for monitoring the current behaviour of each unit, and comparing means for comparing the current behaviour of each unit with the predetermined behaviour pattern corresponding to that unit for detecting changes in behaviour patterns.
According to the invention, there is also provided apparatus for monitoring calls made by customers in a wireless telephone network, comprising means defining a plurality of different predetermined calling patterns appropriate to different types of customers to the network, means for allocating each customer to a particular one of the predetermined calling patterns according to their respective previously determined calling patterns, means for monitoring calls to the network and for determining for each customer the 2 current one of the predeternilned calling patterns which is appropriate to that customer, transition detecting means for comparing the current calling pattern of a particular customer with the previously determined calling pattern for that customer and for detecting any difference in the compared calling patterns thereby to record a transition by the customer from the previously determined calling pattern to the current calling pattern, and transition processing means responsive to any said transition for a particular customer whereby to produce an alert in response to certain transitions and not in response to other transitions.
According to the invention, there is further provided a method of classifying and monitoring the behaviour of each of a plurality of variable-behaviour units, comprising the steps of storing data representing definitions of a plurality of different predetermined patterns of behaviour, classifying each of the units into one of the predetermined patterns of behaviour according to the previously determined behaviour of that unit, monitoring the current behaviour of each unit, and comparing the current behaviour of each unit with the predetermined behaviour pattern corresponding to that unit for detecting changes in behaviour patterns.
According to the invention, there is yet further provided a method of monitoring calls made by customers in a wireless telephone network, comprising the steps of defining a plurality of different predetermined calling patterns appropriate to different types of customers to the network, allocating each customer to a particular one of the 3 predetermined calling patterns according to their respective previously determined calling patterns, monitoring calls to the network and determining for each customer the current one of the predetermined calling patterns which is appropriate to that customer, comparing the current calling pattern of a particular customer with the previously determined calling pattern for that customer and detecting any difference in the compared calling pattern thereby to record a transition by the customer from the previously determined calling pattern to the current calling pattern, and responding to any said transition for a particular customer whereby to produce an alert in response to certain transitions and not in response to other transitions.
Apparatus and methods according to the invention, for profiling the behaviour of customers of a cellular telephone network, will now be described, by way of example only, with reference to the accompanying drawings in which:
Figure I is a diagram showing different possible behaviour patterns; and Figure 2 is a diagram of one form of the apparatus For many purposes, it is desirable to monitor patterns of human behaviour, such as for commercial purposes or for purposes of safety or security or for the detection of fraud. More specifically, it may be desirable to monitor changes in patterns of behaviour, because such changes may have commercial or security implications. A particular 4 example where the monitoring of changes in patterns of behaviour is of potential significance is in telecommunications or telephone systems. A customer of a telephone network is identified to the network by the customer's telephone number (or by some identification derived from, or from which the telephone number is derived) even though it may be that the actual identity of the subscriber is not known (such as in the case of a pre-paid customer in the cellular telephone system). The telephone network can monitor the general "pattern" of calls made by the customer in the network - that is the general type of calls (for example, called destinations) and their time distribution (that is, the times of day and the days of the week when the customer makes most calls). Ifis desirable to be able to detect changes in such behaviour patterns, because this may indicate commercial possibilities to the network operator (for example, the customer could be offered a different tariff) or may suggest fraudulent activity within the network in particular in the case of a wireless or cellular telephone network, that the customer's telephone handset has been stolen and is being fraudulently mis-used by someone else.
Figure I shows at A a "Customer Behaviour Space" which is considered to embrace all possible calling patterns of a customer in a telecommunications network which, for the sake of example, will be considered to be a cellular telephone network. The space A is sub-divided into a number of regions B, C, D, E, F, G, H, 1, J, K. Each region represents the behaviour pattern of a particular group of customers of the network. Customers may be grouped, according to well-defined calling criteria, into such groups as "Pensioner", "Student", "Premium-Rate", "Business", "International Business", "Normal" and others.
By monitoring the pattern of called numbers of each customer over a period of time, it is possible for the network to allocate each customer to a particular group or corresponding region - that is, so that each customer falls within a particular one of the regions B to K in the customer behaviour space A of Figure 1. In accordance with a feature of the invention, the network monitors the customer behaviour to detect changes or divergencies - that is, changes in a customer's behaviour such that the behaviour no longer falls within the region to which that customer's behaviour has been allocated. However, in accordance with the invention, the network does not merely respond when the behaviour of a particular customer falls outside the customer's "normal" region, but responds according to the type of the change or transition in behaviour. Thus, some transitions (behaviour changes from one region into another) may be acceptable (that is, not generating an alert or feedback) whereas others may not be acceptable and may indicate an abnon-nal behaviour, giving rise to an alert or feed back. Such an alert or feedback may be indicative of fraudulent mis-use of the customer's handset (e.g. after theft). Howev this is not necessarily so; it may simply indicate a genuine change in customer er, behaviour (for example, if a student's studies have finished and the student has now taken up employment requiring telephone use for business purposes). In another example, a pensioner's normal telephone use might embrace occasional international telephone calls at weekends or evenings. However, sudden and frequent use of such a customer's telephone for international calls (eg. to North America) during business hours would indicate a transition to an "International Business" region, and such a transition might be deemed to be unacceptable and give rise to an alert.
In accordance with another feature of the invention, the monitoring of transitions can also be used to optimise and refine the rules which define the boundaries between the regions. A large number of transitions between two regions may indicate that the boundary between them is incorrectly defined. A few transitions may indicate that one or more additional regions is required.
Figure 2 shows a call monitoring system 10. The call monitoring system 10 is fed with a flow of call records from the telephone network 12. Each call record will indicate the customer's identity (not necessarily their actual identity but at least their identity within the network - their telephone number or IMSI), the called number for each call, the time/day of the call and its length.
The call records are received by a call analyser 14 which analyses all call records received over a period of time T1. The call analyser also receives inputs from a profile definition store 16, which defines different patterns of customer behaviour corresponding to the different region (B to K, see Figure 1). Over a period of time T2, the call analyser 14 uses the inputs from the profile definition store 16 to classify the current behaviour of each customer and outputs the result to a transition detector 18. The transition detector 18 receives inputs from a customer profile store 20. This stores the profile, or region, previously allocated to each customer. Therefore, the transition detector 18 can detect any transition which has taken place (during the time T2) for a particular customer, by comparing the customer's current profile or region from the call analyser 14 with the 7 stored customer profile or region from the customer profile store 20. The detected transitions are fed to a transition processor 22. This operates under control of a transition rule store 24. This stores rules concerning 'pennissible' and 'impermissible' transitions. Thus, the transition processor 22 compares any transition detected, for a particular customer, by the transition detector 18 with the output from the transition rule store 24 to determine whether or not to produce an alarm. Any alarm signal is passed to an alann processor 26 for appropriate action by the network operator.
As already explained, an alarm could indicate fraudulent mis-use of customer's telephone handset. Instead though, it could indicate a change in a customer's behaviour which could act as a trigger for offering new services to the customer.
An adaptation system 28 receives several inputs. For example, it receives inputs from the call analyser 14 representative of the current profile or behaviour region detected for each customer. It also receives inputs from the transition detector 18 indicative of detected transitions, and the alarm outputs from the transition processor 22. The adaptation system 28 uses these inputs over a period of time T3 to determine whether modification of the data stored in the profile definition store 16, the customer profile store 20 and the transition rules store 24 should be adapted. Thus, for example, as already explained, the existence of many transitions (as detected by the transition detector 18) may cause the adaptation system 28 to change the definitions of some or all of the behaviour regions, by changing the data stored in the profile definition store 16.
If outputs from the call analyser 14 repeatedly show that a particular customer is now operating in a particular behaviour region which is different from the one stored in the customer profile store 20, the adaptation system responds by changing the data in the profile store 20 in order to re-classify that customer into a different region. Similarly, the adaptation system 28 may change the definition of the rules in the transition rules store 24 (for example, in response to changes in the definitions of the behaviour region).
The length of time TI may be varied according to the precision of monitoring required. T2 should be not more that T1, in order to enable real-time monitoring and to ensure that transitions are not missed. T3 should be much greater than T I (e.g. 100 times greater) otherwise the system will become unstable.
Although the invention has been specifically described with reference to the classification of customer behaviour in a telephone network, it may be used in other applications, not concerned with telecommunications, where customer behaviour can be readily monitored.
9
Claims (30)
1. Apparatus for classifying and monitoring the behaviour of each of a plurality of variable-behaviour units, comprising a data store for storing data representing definitions of a plurality of different predetermined patterns of behaviour, means for classifying each of the units into one of the predetermined patterns of behaviour according to the previously determined behaviour of that unit, behaviour monitoring means for monitoring the current behaviour of each unit, and comparing means for comparing the current behaviour of each unit with the predetennined behaviour pattern corresponding to that unit for detecting changes in behaviour patterns.
2. Apparatus according to claim 1, in which the behaviour monitoring means at least temporarily classifies the current behaviour of the unit into one of the predetermined behaviour patterns, and in which the comparing means compares the patterns of a particular unit's current behaviour with the predetermined behaviour pattern to which it is previously allocated.
3. Apparatus according to claim 2, in which the comparing means comprises means for detecting when the behaviour pattern for the current behaviour of a particular unit is different from the previously allocated behaviour pattern for that unit and for determining a transition accordingly which is dependant upon the two behaviour patterns, and including transition processing means for comparing each transition with predetermined data corresponding to the various possible transitions whereby to produce an alert in response to certain transitions and not in response to other transitions.
4. Apparatus according to claim 2 or 3, including adaptation means responsive to data relating to the current behaviour pattern of a variable-behaviour unit for changing the previously allocated behaviour pattern for that unit.
5. Apparatus according to claim 3, including adaptation means responsive to data representing the current behaviour pattern of a particular variable- behaviour unit and to data representing said transitions for changing the definitions of the behaviour patterns.
6. Apparatus according to claim 3, including adaptation means responsive to data representing the current behaviour pattern of a particular variable- behaviour unit, to data representing said transitions, and to data representing said alerts, for changing the transitions which produce the alerts.
7. Apparatus according to any preceding claim, in which each variablebehaviour unit is a living organism.
8. Apparatus according to claim 7, in which the living organism is a human.
9. Apparatus according to claim 8, in which the human is a customer in a telecommunications network.
10. Apparatus according to claim 9, in which the network is a wireless telephone network.
11. Apparatus according to claim 10, in which each behaviour pattern is a telephone call pattern relating to a particular type of customer.
12. Apparatus for monitoring calls made by customers in a wireless telephone network, comprising means defining a plurality of different predetermined calling patterns appropriate to different types of customers to the network, means for allocating each customer to a particular one of the predetermined calling patterns according to their respective previously determined calling patterns, means for monitoring calls to the network and for determining for each customer the current one of the predetermined calling patterns which is appropriate to that customer, transition detecting means for comparing the current calling pattern of a particular customer with the previously determined calling pattern for that customer and for detecting any difference in the compared calling patterns thereby to record a transition by the customer from the previously determined calling pattern to the 12 current calling pattern, and transition processing means responsive to any said transition for a particular customer whereby to produce an alert in response to certain transitions and not in response to other transitions.
13. Apparatus according to claim 12, in which the transition processing means compares each said transition with the predetermined data classifying each of all possible transitions into a respective one of at least two types, whereby to produce an alert if the transition is of the first type and not to produce an alert if the transition is of the second type.
14. Apparatus according to claim 12 or 13, including adaptation means responsive to data representing determinations of a customer's current calling pattern for changing the previously determined calling pattern for that customer.
15. Apparatus according to claim 13, including adaptation means responsive to data representing determinations of a particular customer's current calling pattern and to data representing said transitions by that customer for adjusting the predetermined data classifying all possible transactions.
16. A method of classifying and monitoring the behaviour of each of a plurality of variable-behaviour units, comprising the steps of storing data representing definitions of a plurality of different predetermined patterns of behaviour, 13 classifying each of the units into one of the predetermined patterns of behaviour according to the previously detennined behaviour of that unit, monitoring the current behaviour of each unit, and comparing the current behaviour of each unit with the predetermined behaviour pattern corresponding to that unit for detecting changes in behaviour patterns.
17. A method according to claim 16, in which the monitoring step at least temporarily classifies the current behaviour of the unit into one of the predetermined behaviour patterns, and in which the comparing step compares the patterns of a particular unit's current behaviour with the predetermined behaviour pattern to which it is previously allocated.
18. A method according to claim 17, in which the comparing step comprises the steps of detecting when the behaviour pattern for the current behaviour of a particular unit is different from the previously allocated behaviour patterns for that unit and for determining a transition accordingly which is dependant upon the two behaviour patterns, and including the step of comparing each transition with predetermined data corresponding to the various possible transitions whereby to produce an alert in response t o certain transitions and not in response to other transitions.
19. A method according to claim 17 or 18, including the step of responding to data 14 relating to the current behaviour pattern of a variable-behaviour unit for changing the previously allocated behaviour pattern for that unit.
20. A method according to claim 18, including the step of responding to data representing the current behaviour pattern of a particular variablebehaviour unit and to data representing said transitions for changing the definitions of the behaviour patterns.
21. A method according to claim 18, including the step of responding to data representing the current behaviour pattern of a particular variablebehaviour unit, to data representing said transitions, and to data representing said alerts, for changing the transitions which produce the alerts.
22. A method according to any one of claims 16 to 21, in which each variablebehaviour unit is a living organism.
23. A method according to claim 2 1, in which the living organism is a human.
24. A method according to claim 23, in which the human is a customer in a telecommunications network.
25. A method according to claim 24, in which the network is a wireless telephone network.
26. A method according to claim 25, in which each behaviour pattern is a telephone call pattern relating to a particular type of customer.
27. A method of monitoring calls made by customers in a wireless telephone network, comprising the steps of defining a plurality of different predetermined calling patterns appropriate to different types of customers to the network, allocating each customer to a particular one of the predetermined calling patterns according to their respective, previously determined calling patterns, monitoring calls to the network and determining for each customer the current one of the predetennined calling patterns which is appropriate to that customer, comparing the current calling pattern of a particular customer with the previously determined calling pattern for that customer and detecting any difference in the compared calling pattern thereby to record a transition by the customer from the previously determined calling pattern to the current calling pattern, and responding to any said transition for a particular customer whereby to produce an alert in response to certain transitions and not in response to other transitions.
28. A method according to claim 27, in which the step of responding to any said transition for a particular customer compares each said transition with determined data classifying each of all possible transitions into a respective one of at least two 16 types, whereby to produce an alert if the transition is of the first type and not to produce an alert if the transition is of the second type.
29. Apparatus for monitoring the calling behaviour of customers in a telecommunications network, substantially as described with reference to the accompanying drawings.
30. A method of monitoring the calling patterns of customers in a telecommunications network, substantially as described with reference to the accompanying diagrammatic drawings, 1.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| GB0021511A GB2366699B (en) | 2000-09-01 | 2000-09-01 | Apparatus and methods for behaviour profiling |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| GB0021511A GB2366699B (en) | 2000-09-01 | 2000-09-01 | Apparatus and methods for behaviour profiling |
Publications (3)
| Publication Number | Publication Date |
|---|---|
| GB0021511D0 GB0021511D0 (en) | 2000-10-18 |
| GB2366699A true GB2366699A (en) | 2002-03-13 |
| GB2366699B GB2366699B (en) | 2004-07-14 |
Family
ID=9898682
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| GB0021511A Expired - Fee Related GB2366699B (en) | 2000-09-01 | 2000-09-01 | Apparatus and methods for behaviour profiling |
Country Status (1)
| Country | Link |
|---|---|
| GB (1) | GB2366699B (en) |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2003021486A1 (en) * | 2001-08-30 | 2003-03-13 | Infonox On The Web | Maintaining biometrically identifying customer entity profile database |
| WO2008105685A1 (en) | 2007-02-26 | 2008-09-04 | Telefonaktiebolaget Lm Ericsson (Publ) | A method and apparatus for monitoring client behaviour. |
| EP2224771A1 (en) * | 2009-02-27 | 2010-09-01 | BRITISH TELECOMMUNICATIONS public limited company | Access point information server |
| US8165563B2 (en) | 2006-09-21 | 2012-04-24 | Vodafone Group Plc | Fraud detection system |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| GB2303275A (en) * | 1995-07-13 | 1997-02-12 | Northern Telecom Ltd | Detecting mobile telephone misuse |
| WO2000064193A2 (en) * | 1999-04-20 | 2000-10-26 | Amdocs Software Systems Limited | Telecommunications system for generating a three-level customer behavior profile and for detecting deviation from the profile. |
-
2000
- 2000-09-01 GB GB0021511A patent/GB2366699B/en not_active Expired - Fee Related
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| GB2303275A (en) * | 1995-07-13 | 1997-02-12 | Northern Telecom Ltd | Detecting mobile telephone misuse |
| WO2000064193A2 (en) * | 1999-04-20 | 2000-10-26 | Amdocs Software Systems Limited | Telecommunications system for generating a three-level customer behavior profile and for detecting deviation from the profile. |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2003021486A1 (en) * | 2001-08-30 | 2003-03-13 | Infonox On The Web | Maintaining biometrically identifying customer entity profile database |
| US7085774B2 (en) | 2001-08-30 | 2006-08-01 | Infonox On The Web | Active profiling system for tracking and quantifying customer conversion efficiency |
| US8165563B2 (en) | 2006-09-21 | 2012-04-24 | Vodafone Group Plc | Fraud detection system |
| WO2008105685A1 (en) | 2007-02-26 | 2008-09-04 | Telefonaktiebolaget Lm Ericsson (Publ) | A method and apparatus for monitoring client behaviour. |
| EP2127302A4 (en) * | 2007-02-26 | 2016-04-27 | Ericsson Telefon Ab L M | A method and apparatus for monitoring client behaviour. |
| EP2224771A1 (en) * | 2009-02-27 | 2010-09-01 | BRITISH TELECOMMUNICATIONS public limited company | Access point information server |
| WO2010097588A1 (en) * | 2009-02-27 | 2010-09-02 | British Telecommunications Public Limited Company | Access point information server |
Also Published As
| Publication number | Publication date |
|---|---|
| GB2366699B (en) | 2004-07-14 |
| GB0021511D0 (en) | 2000-10-18 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US6732082B1 (en) | System, method and computer program product for processing event records | |
| US8170947B2 (en) | Fraud detection based on call attempt velocity on terminating number | |
| US6526389B1 (en) | Telecommunications system for generating a three-level customer behavior profile and for detecting deviation from the profile to identify fraud | |
| US7570751B2 (en) | System and method for real-time fraud detection within a telecommunication network | |
| EP1583314A2 (en) | Detection of outliers in communication networks | |
| US6636592B2 (en) | Method and system for using bad billed number records to prevent fraud in a telecommunication system | |
| US20060269050A1 (en) | Adaptive fraud management systems and methods for telecommunications | |
| GB2366699A (en) | Detecting changes in a customer's behaviour profile | |
| US7631355B2 (en) | System and method for identifying extreme behavior in elements of a network | |
| KR20080077187A (en) | Method for call-theft detection | |
| CA2371730A1 (en) | Account fraud scoring | |
| US5517175A (en) | Potential adjusting sensor supervision circuit | |
| US6466778B1 (en) | Monitoring a communication network | |
| CA2296328C (en) | Monitoring a communication network | |
| AU2003204506B2 (en) | Monitoring a communication network | |
| JPH08228211A (en) | Fault detector | |
| EP1417827A1 (en) | Method and system for preventing fraud in a telecommunications system | |
| MXPA98007768A (en) | Fraud prevention in a telecommunication network |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PCNP | Patent ceased through non-payment of renewal fee |
Effective date: 20170901 |