OA16534A - A bypass detection system resembling human behaviour. - Google Patents

Abstract

There is provided a control system (40) for a system (1) for detection of a bypass (540) of an interconnect (530) to a telecommunication network (50), said control system (40) configured to : * initiate one or more test calls between at least one means (10) adapted to originate a test call to a telecommunication network (50) under test from outside the telecommunication network (50) under test; and at least one receiver probe (20) with a subscription (201, 202) for terminating said test call; * receive from the receiver probe (20) call information comprising a received calling line identification (CLI) of the respective test calls; and * analyse the received calling line identification (CLI) in order to detect the presence of the bypass (540) when the bypass (540) is present during the test call. According to the invention a number of said test calls is picked up by said receiver probe (20).

Description

A BYPASS DETECTION SYSTEM RESEMBLING HUMAN BEHAVIOUR

Field of the Invention

The présent invention generally relates to a system for détection of an interconnect bypass in télécommunication networks, especially in wireless télécommunication networks such as for example of the type GSM, UMTS or similar, but also in wired télécommunication networks.

Background ofthe Invention

When a télécommunication network operator provides access from his network to a network of another télécommunication network operator and vice versa, both operators, by means of agreement or sometimes subject to regulatory requïrements, set up a suitable interconnection facility which is subjected to extensive testing in order to assess technical reliability and the quality of service of the interconnection facility so that the agreed upon or regulatory standards are met. Next to the technical arrangements there are in many cases also interconnection charges that the télécommunication network operator receiving a call charges for the calls passing through the interconnection facility. When a calling party calls from another télécommunication network to the network of the télécommunication network operator of the receiving party, for example because the calling party is a client of another network operator than the receiving operator or because the calling party is abroad and is making use of a partnering network operator that provides roaming services for its network operator, this call has to pass through the interconnection facility.

Sometimes there are attempts to bypass the interconnection facilities of the network operator in an attempt to make money by avoiding at least a part of the interconnection charges. These attempts are made by bypass operators that reroute a part of the traffic of calling parties within the network of another operator to the network of the receiving operator without going through the interconnection facility. Generally these bypass operators make use of end user facilities from the receiving operator.

This leads to a direct loss of revenue for the receiving network operators and this leads to technical problems. First of ail as the bypass operator uses end user facilities to provide a network interconnection. Furthermore the use of these end user facilities and the setup of a new call créâtes an additional interface. Therefor there is a serious risk of quality problems such as degraded quality of audio or data transmissions, interruptions during the call, a

-2prolonged waiting time during the call initiation, unacceptable delays in the transmissions, ... . Further, because of the bypass operators reroute the call by setting up a new call making use of end user facilities of the receiving operator, the CLI of the calling party will be replaced with the CLI of the new call. This leads to inconveniences for the receiving parties which receive an erroneous or no CLI, but can also hâve more serîous safety issues involved when a call to emergency services or police is involved. Furthermore this also créâtes serîous technical difficulties for automatic téléphoné switchboards that operate on the basis of the CLI of the incomlng call.

A system for setting up test calls in a télécommunication network is known from for example WO99/01974 and W02008/071857. These call charge vérification Systems generate a sériés of calls between different sites on one or more networks to enable the network operator to check the billing procedure of the network. These Systems however rely on collection of billing data produced by the operator in order to extract data, such as for example the CLI for analysis. Therefor these Systems require access to sensitive data of the télécommunication network operator. This data is sensitive because it is related to the calling behaviour of its customers which might be subjected to privacy régulations or because it relates to billing information which is considered as commercial know how of the télécommunication network operator. These problème are especially relevant if the call charge vérification system is operated by third parties that offer such system as a service to the télécommunication network operator. As then extensive access by these third parties to information of the télécommunication network operator requires spécifie interfaces to be developed to provide access to the billing information for each spécifie télécommunication network operator. This is time and resource intensive and makes it difficult to scale the vérification system to multiple télécommunication network operators,

A known system that overcomes the abovementioned drawbacks is the Meucci system as described on their website: http://www.meucci-solutions.com. This system for détection of a bypass of an interconnect to a télécommunication network under test comprises means adapted to originate a test call to said télécommunication network under test from outside the télécommunication network under test and at least one receiver probe with a subscription for terminating said test call. Further this system comprises a control system configured to initiate the test call; receive from the receiver probe call information comprising a received calling line identification (CLI) of the test call; and analyse the received calling line identification (CLI) such that presence of the bypass can be detected. The Meucci system does not require an interface with the billing system. Usage of the CLI for détection of a bypass based on a test call system is also mentîoned in the prior art section of US2010/0087191. Test call Systems in general are for example known from WO2010/144020 and EP0661859.

-3In order to limit costs of testing call attempts are favoured over answered calls. The bypass détection as described only requires a call attempt and does not require an answered call. So if for instance ten thousand test calls are to be made, the cost of making ten thousand call attempts is vastly different from the cost of making ten thousand calis that are answered, because in most cases call attempts are not charged. Therefor call attempts are preferred over answered calls. When designing a test call system for détection of SIM-boxes that is based on analysis of the CLI, the person skilled in the art would be aware of the problem of the extra cost such test calls would generate, such as for example mentioned in the prior art section of US2010/0087191. The télécommunication quality measurement system of WO 2010/144020 provides a solution to this cost problem as it clearly indicates, for example on page 12, line 6, that CLI forwarding tests are carried out without seizing calls. However, this combination of the teachings of the CLI quality measurement as applied to a bypass détection system making use of CLI based test calls, would resuit in a system in which no test calls would be seized, both in the context of a bypass détection System or a quality measurement System.

EP0661859 describes traffic route testera which check transmission quality such as for example voice or data transmission quality and generate random traffic in a system which corresponds to subscriber traffic. However, in order to check the transmission quality a connection has to be established.

So in summary when measuring spécifie parameters like CLI, one would never pick up the test calls to avoid costs and increase efficiency and when measuring other parameters like transmission quality one would always pick up the test calls because it is requîred for the measurement.

One problem with these Systems that make use of test calls is that they hâve an easily identifiable calling behaviour. This makes the calling pattern different from normal, predominantly human, calling patterns and thus easy to identify. In the spécifie situation where test calls are never picked up this results in an easily identifiable calling pattern as the answer/seizure ratio (ASR), this is the number of successfully answered calls divided by the total number of calls attempted (seizures) multiplied by one hundred, would be approaching 0%, because of the tendency not to seize any test calls in order to reduce the cost. Such an ASR is clearly different from normal, predominantly human, calling patterns and thus easier to identify both in the context of a bypass détection system or a quality measurement system. For example a téléphoné number that receives one hundred call attempts per day and never picks up is very suspicious. On the other hand, transmission quality check Systems, when used as a bypass détection system, would lead to unacceptable costs and a

-4serious réduction of efficiency when applying this technology in the technical context of the current invention because of the requirement to establish a connection in order to complété the quality check. Furthermore, even when generating random traffic, such a transmission quality check systern would resuit in an easily identifiable calling pattern as the ASR would be approaching 100%, because of the tendency to seize ail test calls in order to perform the quality check. Such an ASR is clearly different from normal, predominantly human, calling patterns and thus easier to identify. For example a téléphoné number that receives one hundred calls per day and always picks up is equally suspicious.

Furthermore, such test call Systems are computer driven and may show a fixed or easy to identify calling pattern of start time, ringing duration, number of rings, etc. This makes it easy for the bypass operators to detect and identify the means for originating the test calls and/or the subscriptions used in the receiver probes for receiving the test call. These bypass operators can then subsequently blacklist these spécifie means and/or subscriptions in order to avoid détection.

As such there is a need for a systern that can provide real time information about the availability of a bypass. This System should be able to be operated by third parties and should not require access to sensitive data of the télécommunication network operator. The systern should also hâve a decreased risk of counter-detection by a bypass operator. The systern should also be able to decrease the risk of counter-detection without unduly Increasing the associated cost.

Summary of the Invention

According to a first aspect of the invention there is provided a control systern for a System for détection of a bypass of an înterconnect to a télécommunication network , said control systern configured to:

initiate one or more test calls between at least one means adapted to originate a test call to a télécommunication network under test from outside the télécommunication network under test; and at least one receiver probe with a subscription for terminating said test call;

receive from the receiver probe call information comprising a received calling line identification of the respective test calls; and analyse the received calling line identification in order to detect the presence of the bypass when the bypass is présent during the test call,

CHARACTERIZED IN THAT said control systern is configured to instruct said receiver probe to pick up a number of said test calls for avoiding counter-detection by a bypass operator while limiting costs.

-5By picking up a number of the test calls the answer/seizure ratio, this is the number of successfully answered calls divided by the total number of calls attempted (seizures) multiplied by one hundred, of the associated means and/or subscriptions will be doser to that of normal human calling behaviour and thus make it more difficult for the bypass operators to identify. This cîearly differentiates from prior art Systems which would lead to driving the ASR down, ideally to 0% for certain type of measurements on the one hand and prior art Systems which would lead to driving the ASR up, ideally to 100% for other types of measurements on the other hand, as explained above. It would be totally counter-intuitive for the skilled person to drive the ASR of the test calls up when he is focussed on CLI analysis or to drive the ASR of the test calls down when he is focussed on transmission quality checks. The system according to the invention successfully minimizes the risk of counter-detection by an increased cost above what is required to technically perform the test calls, but in such a way that the increase is minîmized while the chances on avoiding counter détection are maximized both in the context of bypass détection as well as in the context of quality measurement.

According to an embodiment of the invention said control system is configured to instruct said receiver probe to pick up only a number of test calls on suspect routes, which are routes for test calls for which said control system: has previously detected the bypass;

is provided with information that the probability of detecting a bypass is higher than a predetermined bypass probability threshold; or is in the process of detecting the bypass.

While reducing the risk of counter détection this additionally keeps the system efficient as no time or money is wasted on picking up the test call for routes that do not seem to contain a bypass. In this application the term “route” is used for ail means on a spécifie telecom operator or telecom provider that guide a spécifie test call from where it was originated to a spécifie receiving subscription or operator, subject to routing rules through various télécommunication networks. A suspect route is a route for a spécifie test call for which the control system has previously detected or is in the process of detecting a bypass, or for which there is information that the probability of detecting a bypass is expected to be higher than a predetermined bypass probability threshold. The probability of detecting a bypass can be based on information, such as for example the results of previous tests or pricing information. Previous tests on a spécifie route could for example hâve indicated that 5% of the test calls contained a bypass. If the bypass probability threshold was set to for example 1%, then this route would qualify as a suspect route. This bypass probability threshold could

-6be set by an operator of the bypass détection system, but could aiternatively also be calculated from for example the average bypass détection rate of the bypass détection system. Aiternatively the probability of detecting a bypass and the corresponding bypass probability threshold can be derived from the time that has elapsed since the détection of a bypass, and as such if a bypass was detected on a route more recently than the time period defined by the predetermined bypass probability threshold, the this route would qualify as a suspect route. Aiternatively a the probability of detecting a bypass can be derived from pricing or revenue information. In such a case the predetermined bypass probability threshold could relate to a spécifie pricing or revenue level and a route would qualify as a suspect route if the pricing or revenue level îs lower than the one set by this threshold. According to still a further alternative suspect routes, could be routes which are reported to contain sim boxes, for example by another bypass détection system, or a bypass détection System fitted for other télécommunication networks than the télécommunication network under test It is clear that the bypass probability threshold could for example also be set to 0%, which means that as soon as for example a bypass was detected by another bypass détection system on a route, this route will qualify as a suspect route. Differentiating the test call strategy on these suspect routes, with a focus on avoiding counter-detection, from the other test calls, allows for a setup that introduces additional flexibility. The same performance as with prior art Systems that strive either for an ASR of 0%, such as for example CLI based quality check Systems or bypass détection Systems, or for an ASR of 100%, such as for example transmission quality check Systems, are attainable for the test calls along a route for which no bypass is présent, no bypass was présent or the probability of a bypass being présent was below a predetermined bypass probability threshold. However only a limited or no compromise results with regard to the rîsk of counter-detection based on analysis of the ASR of the test calls on suspect routes, because it is only important that the test calls show human behaviour if they are on a route that comprises a bypass or has a probability of comprising a bypass which is higher than the predetermined bypass probability threshold. If no bypass has been detected yet or for a predetermined period of time, it is préférable to only introduce human behaviour as soon as one test call has led to the détection of a bypass. The détection of a bypass on such a suspect route could optionally be performed during the initial connection phase of the test call which could then subsequently be seized. Such routes may change over time as routing of for example international calls is known to be dynamic. However in alternative embodiments where costs associated with test calls are less an issue, human behaviour may be applied to ail test calls on ail routes.

According to a further embodiment of the invention said control system is configured to instruct said receiver probe to pick up only between 20% to 70%, preferably 40% of test

-7calls on suspect routes. These answer/seizure ratios should be based on normal industry ratio’s, such that there is little différence between what is artifrcially created by the test system and what would be the expected normal behaviour for the body managing or operating the route. In general the ASR varies between 50 and 70%.

These answer/seizure rates offer a good compromise between efficiency of execution of the test calls and avoiding counter détection by the bypass operator.

According to still a further embodiment of the invention said control system (40) is configured to instruct said receiver probe (20) to pick up the test call on suspect routes based on said analysis of the received calling line identification (CLI).

The received CLI is transmitted just before or after the first ring. The analysis of the CLI which leads to the détection of the presence of a bypass can thus be performed while the test call is ringing and on the basis of the outcome it can be decided whether to pick up the test call or not. This allows for an efficient, real time system with capabilities to avoid counter détection by the bypass operator.

According to still a further embodiment said control system is further configured to instruct said means and/or said receiver probe to randomize one or more test call parameters, such as one or more of the following: start time of a test call;

duration of a test call;

ringing duration of a test call; and timing of one or more signalling messages of a test call.

The random behaviour removes the ability for counter détection of the systematic calling behaviour of prior art test calls.

According to still a further embodiment said control system is further configured to instruct said means and/or said receiver probe to inject content in said test calls, such as one or more of the following:

DTMF tones;

noise; and speech.

In this way the test calls even more closely resemble normal human calling behaviour which reduces the risk of counter détection.

-8According to a further embodiment the control system at least partly is comprised within said receiver probe.

The control system can thus optionally be implemented in a distributed way, for example in order to speed up processing.

According to a second aspect of the invention there is provided a system for détection of a bypass of an interconnect to a télécommunication network, said system comprising a control system according to any of the preceding claims, said system further comprising: at least one means adapted to originate a test call to a télécommunication network under test from outside the télécommunication network under test; and at least one receiver probe with a subscription for terminating said test call.

According to an advantageous embodiment said subscription for terminating said test call is confîgured with calling line identification restriction override (CLIRO).

This allows to overcome difficulties for detecting and disabling a bypass when the bypass operator makes use of the CLIR function in order to mask the calling line identification of their bypass equipment This enables to identify and subsequently disable the subscriptions that are being used by a bypass even if the bypass operator makes use of the CLIR function. When third parties provide the system for détection of a bypass as a service to a télécommunication network operator this requires neither access sensitive data like for example billing date nor complex technical interfaces to provide that access. The third party only requires access to a subscription confîgured with CLIRO for terminating the test call.

According to a third aspect of the invention there is provided a method for detecting a bypass of an interconnect to a télécommunication network under test, said method comprising the steps of:

the means originating a test call to said télécommunication network under test from outside the télécommunication network under test;

the at least one receiver probe with a subscription terminating said test call; and a control system initiating the test call; receiving from the receiver probe call information comprising a received calling line identification of the test call; and analysing the received calling line identification in order to detect the presence of the bypass when the bypass is présent during the test call,

CHARACTERISED IN THAT THAT the method comprises the further step of the control system instructing the receiver probe to pick up a number of said test calls for avoiding counter-detection by a bypass operator while lîmiting costs.

-9Brief Description ofthe Drawings

Fig. 1 illustrâtes an embodiment according to the invention without the presence of a bypass; and

Fig. 2 illustrâtes the embodiment according to Figure 1 with the presence of a bypass.

Detailed Description of Embodiment(s)

Figure 1 shows a system 1 for détection of a bypass of an interconnect 530 to a télécommunication network 50 under test. The system 1 according to the invention comprises a means 10 to originale a test call to said télécommunication network 50 under test from outside the télécommunication network 50 under test. This means 10 can be a suitable sender probe such as for example a GSM mobile phone or any other type of device capable of initiating a call on a predetermined outside télécommunication network other than the télécommunication network 50 of the network operator that is undertaking the investigation regarding the presence of a bypass of an interconnect 530, such as for example calling cards, a téléphoné number providing access to voip Systems, call back mechanisms, any type of pc origînating calls, a suitable subscription to mobile networks such as for example a SIM card, wireline networks or call generators directly connected to télécommunication network equipment. The means 10 can comprise for example a fixed line subscription in the UK +44 20 1234 5678 and the télécommunication network 50 under test can for example be a télécommunication network of a Belgian mobile operator with a numbering plan with a 474 prefix, this means “+32 474 xxx xxx”. The means 10 is for this purpose connected to a suitable control system 40 which enables to înîtiate the test call according to instructions received from this control system 40. The control system 40 is for example a suitably programmed computer that is directly connected to the means 10, but it might also be a remote computer system that is connected to the means 10 by means of a suitable network interface, such as for example a LAN or the internet, to enable exchange of instructions and/or data through this networks. It is clear that the system 1 for détection of a bypass is not limited to a system with only one means 10, it can however comprise any suitable number of means 10 dispersed among any suitable number of outside télécommunication networks, such as for example eight means 10 for different télécommunication networks in France and three means 10 for roaming télécommunication network partners in Ghana.

-10As can be seen in Figure 1 the bypass détection system 1 also comprises a receiver probe 20. This receiver probe 20 can for example also be a GSM mobile phone or any other type of device with a subscription for terminating the test call. The receiver probe 20 can for example comprise a subscription to the télécommunication network 50 under test “+32 474 123 456. The receiver probe 20 is also connected to a suitable control system 40. The control system 40 receives from the receiver probe 20 call information comprising a received calling line identification (CLI) of the test call. It is clear that the system 1 is also not limited to a system with only one receiver probe 20. It can comprise any suitable number of receiver probes 20 with a subscription for terminating test calls.

The call information comprises a received CLI of the test call and optionally other data relating to the call such as for example the time and date the test call was exactly received, the time and date at which the test call started ringing, the time and date at which the test call was terminated, an indicator for whether the test call was picked up, the phone number associated with the means 20, the présentation indicator.....

As shown in Figure 1 when no bypass is présent the control system 40 initiâtes the test call by activating the means 10 which subsequently originates the test call by calling the subscription to the télécommunication network 50 under test in the receiver probe 20. The test call is then sent to the télécommunication network 50 under test, for example optionally via one or more carriers 60. Subsequently the test call passes interconnect 530 of the télécommunication network 50 under test who routes the test call to the receiver probe 20. The receiver probe 20 then receives the incoming test call. It is not required for the receiver probe 20 to actually answer the test call. The control system 40 could for example be configured in such a way that it instructs means 10 to initiate the test call to the receiver probe 20 and to automatically disconnect the test call after allowing three rings. The control system 40 then receives from the predetermined receiver probe 20 call information that comprises a received CLI, which is transmitted just before or after the first ring, and optionally other data concerning the test call. This could be done for example by downloading the call information from the receiver probe 20 to the control system 40 or by transmitting it to the control system 40 in any suitable way, by for example a wired or wireless connection means. The control System 40 then analyses the received CLI.

This analysis can be executed as a simple comparison with the calling party number associated with means 10 that the control system 40 instructed to initiate the test call. In the case illustrated in Figure 1 where the test call passed through the interconnect facility 530 this received CLI, for example “+44 20 1234 5678, will match the calling party number, “+44 20 1234 5678, associated with means 10 and the control system 40 will be able to détermine that for this test call no bypass was detected.

-11 As the means 10 originates the test call from outside the télécommunication network 50 under test, the analysis can be done with even more reduced complexity and increased reliabïlity. It can be determined whether the received CLI is a call that originated from within the télécommunication network 50 under test, this means an on net call, by for example analysing whether the prefix of the received CLI differs from the prefix associated with the numbering plan of the télécommunication network 50 under test If this analysis of the received CLI indicates the calling party of the test call is not from within the télécommunication network under test, no bypass was detected. Thus as soon as the analysis is able to ascertain that the received CLI does not belong to the numbering plan associated with the télécommunication network 50 under test, no bypass within the network under test was detected. In order to also take into account number portability the analysis could comprise a check if the received CLI comprises a number which is comprised in the number database of the télécommunication network 50 under test. If this is not the case, no bypass within the network under test was detected. In general, because the means 10 originates the test call from outside the télécommunication network 50 under test, the presence of a bypass can be detected if the received CLI belongs to a subscription to the télécommunication network 50 under test.

Another possibility for analysis is to check if the received CLI comprises the same country code as the country code associated the télécommunication network 50 under test. As the means 10 in many cases originates a test call from a country other than the one from the télécommunication network 50 under test this provides a tool for determining whether a bypass is présent.

Figure 2 shows the same system 1 according to Figure 1 in operation, but now there is a bypass 540 in place and this bypass 540 reroutes the test call. When the control system 40 now initiâtes a test call between means 10 and receiver probe 20 and the call is rerouted optionally via one or more carriers 60 to the bypass 540 a détection of the bypass 540 is possible as explained below.

Such a bypass 540, also known as for example a GSM gateway or SIM box when it concerns a wireless télécommunication network or a leaky PBX when it concerns a wired télécommunication network, is operated by interconnection bypass operators that route part of the traffic to the télécommunication network 50 under test from outside télécommunication network 50 via for example a suitable internet interface with one of the carriers 60 towards a bypass 540 which normally makes use of a pluralîty of subscriptions, for example “+32 474 111 222, that operate within the télécommunication network 50 under test and which convert the incoming test call into a new call originating from a subscription

-12to the télécommunication network 50, “+32 474 111 222, and to the same destination and as such bypass the interconnect 530. However when the control system 40 now receives the receiver call information from the receiver probe 20 that received the test call initiated from means 10, the received CLI, “+32 474 111 222 will not match the calling party number, “+44 20 1234 5678, associated with means 10. This is because instead of the calling party number of means 10, the calling party number of one of the subscriptions in the bypass 540, “+32 474 111 222”, will be in the CLI received by receiver probe 20. The control system 40 is then able to assess that a bypass 530 is présent.

As explained above because the means 10 originates the test call from outsîde the télécommunication network 50 under test, the presence of a bypass 540 can be detected if the received CLI belongs to a subscription to the télécommunication network 50 under test. This can be implemented by checking whether the received CLI comprises a prefix which belongs to the numbering plan of the télécommunication network 50 under test +32 474 xxx xxx or when to also take into account number portability by checking whether the received CLI comprises a number which is comprised in the number database of the télécommunication network 50 under test.

It is clear that the test call results in an identifiable call pattern. The test call after initiation allows for a few rings and is then ended without being picked up. Even when the system 1 initiâtes, originates, receives and analyses a plurality of test calls between a plurality of means 10 and a plurality of receiver probes 20, this identifiable call pattern would enable the bypass operator to easily identify each of those means 10 and/or the subscriptions 201, 202 for terminating the test call used in the receiver probes 20 as the test calls from these means 10 to the these terminating subscriptions 201, 202 are usually not picked up as explained above. The bypass operator or carrier 60 could then blacklist the means 10 and/or the subscriptions 201, 202 for terminating the test call used in the receiver probes 20 and stop routing calls from or to the bypass 540 in order to avoid détection by the system 1.

The System 1 therefor implements counter measures to avoid discovery. The common concept behind these countermeasures is that the system 1 tries to more closely align with normal human calling patterns instead of the calling pattern associated with prior art Systems for identifying a bypass 540.

ln a first embodiment according to the invention this is implemented by configuring system 1, generally by means of its control system 40, to pick up a number of the test calls that are originated by one or more means 10. This will make it more difficult for the bypass operators, or carriers 60 up front involved with routing call traffic to the bypass operators, to detect, by analysing the calling behaviour towards the respective receiver probes 20, the

-13subscriptîons 201, 202 used for terminating the respective test calls and also the respective means 10 used as calling parties to originale the respective test calls. It is not essential to pick up ail the test calls. If for example ten test calls are initiated by the systern 1, four of them could be picked up and the remaining six could still be left unanswered. This allows making a trade-off between the risk of counter détection and the cost associated with picking up the test call. According to a first possîbîlity the control systern 40 for deciding whether to pick up a call could be implemented in the receiver probe 20 itself, but it is equally possible to let the receiver probe 20 be instructed by a separate control systern 40 to pick up a spécifie test call. Or any suitable combination is possible such as for example a distributed control System 40 comprised at least partly within at least one receiver probe 20 and optionally also comprising a separate device forming part of this control System 40.

According to an advantageous embodiment of the systern 1 according to the invention a number of test calls is only picked up by the receiver probe 20 if they originated from a suspect route. As explained above, this means that the test calls for example originated from a route for which there is information indicating the probability of detecting a bypass is expected to be higher than a predetermined bypass probability threshold. According to one of the alternative options explained above this could also mean that an analysis of earlier test calls determined previously that a spécifie route, this is a test call from a spécifie means 10 or set of means 10 outside the network 50 under test to the network 50 under test, contained a bypass 540. The receiver probe 20 could détermine based on information from the control systern 40 or optionally provided by means 10 or the time at which the test call was scheduled when exactly a test call on a spécifie suspect route was received. By limiting the receiver probe 20 to only pick up test calls along this suspect route the cost associated with picking up test calls is further minimized while not unnecessary increasing the risk for counter détection. The Answer/Seizure ratio (ASR) of these test calls, which is the number of picked up calls divided by the total number of calls attempted multiplied by 100, must not necessarily be as high as that associated with normal human behaviour which is normally higher than 50%. The ASR should however be doser to that of normal human behaviour then not picking up any test calls at ail. In this respect the ASR of these test calls could vary in the range of 20% to 70%, such as for example 40%.

According to a further advantageous embodiment détermination of a suspect route is made in real time by analysis of the received CLI during the test call. As the CLI is transmitted just before or after the first ring, the analysis of the CLI which leads to the détection of the presence of a bypass can thus be performed while the test call is ringing. The control systern 40 instructs the receiver probe 20 to pick up the test call or not on the basis of the outcome of this analysis of the CLI. This enables a systern with real time flexibility,

-14enhanced economy and which is simple in implémentation as no data of previous test calls needs to be stored and/or analysed for détermination of suspect routes.

According to still a further embodiment in order to still further approach the calling pattern associated with human behaviour certain of the test call parameters such as the test the start time of a test call, duration of a test call, ringing duration of a test call, etc. or any suitable combination of these parameters could be randomized or could be provided with a pattern that resembles human behaviour. For example instead of a fixed calling pattern for initiating ten test calls every five minutes, the interval between these test calls could be randomized to select random intervals between the initiation of the respective test calls for example in a range between one and ten minutes. Alternatively instead of setting a fixed number of rings to be allowed for ail initiated test calls, whether the control system instructed the receiver probe 20 to pick up or not, a randomized amount of rings could be set up, for example allowing between two and seven rings before picking up or closing ending the test call. For a test call that is answered also the call duration could be randomized, for example between thirty seconds and five minutes. Ail these call parameter randomisations or any suitable combination of them allow to decrease the risk of counter détection because they avoid the availability of a fixed calling pattern that could be detected by the bypass 540 operators in an attempt to counter detect system In order to still further randomise the calling behaviour associated with the test calls said system is optionally further configured to randomize the timing of one or more signalling messages, such as for example: SS7 Initial Address Message (IAM); Address Complété Message (ACM); Answer Message (ANM), and similar signalling messages; or SIP Invite, Progress, OK, Ack, Bye, and similar signalling messages. It îs clear that équivalent signalling messages in use on the télécommunication network to user interface and other technologies also can be considered to be randomised. These signalling messages are for example described in the call flow charts in SS7 spécifications (ITU, 3GPP TS 03.18 ...), SIP spécifications (RFC3261) and similar spécifications for other technologies.

Still a further possibility to further approach human call pattern behaviour is implemented in an embodiment according to the invention by injecting content in the test calls. This content could for example be DTMF tones, noise and/or speech. This avoids the possibility for counter détection by an analysis of the test call content The test calls even when picked up namely don’t contain any content. By injecting content into these test calls the risk for counter détection can even further be reduced. The content could be generated by the means 10 and/or receiver probe 20 in a simple way by for example generating DTMF tones. This capability is available anyhow to means 10 for dialling the test call. As mentioned

-15above noise or recorded speech by for example playing a suitable sound file from a suitable device, such as for example an answering machine, a computer, an mp3 player, ....

When using the system 1, there exists a risk that the operator of bypass 540 makes use of the CLIR function such that the system 1 would not be able to guarantee the détection of the presence and/or subséquent disabling of a bypass 540. The signais exchanged between télécommunication networks namety comprise two fields, a CLI field which contains the calling party téléphoné number and a présentation indicator (PI) which indicates whether the CLI can be shown or not. The PI has three states: available means that there is a CLI and it can be shown, “unavailable means that there is no CLI présent and “restricted” means that there is a CLI présent, but it cannot be shown. When the operator of bypass 540 enables the CLIR function for the subscriptions the bypass 540 makes use of, the last switch in the path will not pass on the CLI to the terminating subscription used in the receiver probe 20. A more detailed description of the CLIR function can for example be found in the ITU CCITT 1.251.4 spécification or the 3GPP TS 24.081 spécification.

Therefore the system according to the invention makes use of a receiver probe 20 that comprises a subscription configured with a calling line identification restriction override (CLIRO) function. This is a feature implemented in the equipment of the télécommunication network 50. The feature will instruct the final switch in the path of the test call to ignore the PI if it is set to “restricted” and still pas on the CLI to the terminating subscription of the receiver probe 20. Then, even if the bypass 540 makes use of a CLIR function the receiver probe 20 will always be able to detect the CLI of the incoming test call. This will enable the system 1 to detect and/or subsequently disable the spécifie subscriptions that are in use in the bypass 540.

In general the method for detecting the bypass 540 of the interconnect 530 to a télécommunication network 50 under test thus comprises the following steps:

the means 10 originate one or more tests call to said télécommunication network 50 under test from outside the télécommunication network 50 under test;

the at least one receiver probe 20 terminâtes said test calls and picks up a number of these test calls; and the control system 40 initiâtes the test calls; receives from the receiver probe 20 call information comprising a received CLI of the test call; and analyses the received CLI in order to detect the presence of the bypass 540 when the bypass 540 is présent during the test call.

Although the présent invention has been illustrated by reference to spécifie embodiments, it will be apparent to those skilled in the art that the invention is not limited to the details of the

- 16foregoing illustrative embodiments, and that the présent invention may be embodied with various changes and modifications without departîng from the scope thereof. The présent embodiments are therefore to be considered in ail respects as illustrative and not restrictive, the scope of the invention being indicated by the appended claims rather than by the foregoing description, and ail changes which corne within the meaning and range of equivalency of the claims are therefore intended to be embraced therein. In other words, it is contemplated to cover any and ail modifications, variations or équivalents that fall within the scope of the basic underlyîng principles and whose essential attributes are claimed in this patent application. It will furthermore be understood by the reader of this patent application that the words comprising or comprise do not exclude other éléments or steps, that the words a or an do not exclude a plurality, and that a single element, such as a computer system, a processor, or another ïntegrated unit may fulfil the functions of several means recited in the claims. Any reference signs in the claims shall not be construed as limiting the respective claims concerned. The terms first, second, third, a, b, c, and the like, when used in the description or in the claims are introduced to distinguish between similar éléments or steps and are not necessarily descrîbing a sequential or chronological order. Similarly, the terms top, bottom, over, under, and the like are introduced for descriptive purposes and not necessarily to dénoté relative positions. It is to be understood that the terms so used are interchangeable under appropriate circumstances and embodiments of the invention are capable of operating according to the présent invention in other sequences, or in orientations different from the one(s) described or illustrated above.

Claims (15)

1. A control system (40) for a system (1) for détection of a bypass (540) of an interconnect (530) to a télécommunication network (50), said control system (40) configured to:

• initiate one or more test calls between at least one means (10) adapted to originate a test call to a télécommunication network (50) under test from outside the télécommunication network (50) under test; and at least one receiver probe (20) with a subscription (201,202) for terminating said test call;

• receive from the receiver probe (20) call information comprising a received calling line identification (CLI) of the respective test calls; and • analyse the received calling line identification (CLI) in order to detect the presence of the bypass (540) when the bypass (540) is présent during the test call,

CHARACTERIZED IN THAT said control System (40) is configured to instruct said receiver probe (20) to pick up a number of said test calls for avoiding counter-detection by a bypass operator while limiting costs.

2. A control system according to claim 1, wherein said control system (40) is configured to instruct said receiver probe (20) to pick up only a number of test calls on suspect routes, which are routes for test calls for which said control System (40):

• has previously detected the bypass (540);

• is provided with information that the probability of detecting a bypass is higher than a predetermined bypass probability threshold; or • îs in the process of detecting the bypass (540).

3. A control system according to claim 2, wherein said control system (40) is configured to instruct said receiver probe (20) to pick up only between 20% to 70%, preferably 40% of test calls on suspect routes.

4. A control system according to any one of the preceding claims, wherein said control system (40) is configured to instruct said receiver probe (20) to pick up the test call on suspect routes based on said analysis of the received calling line identification (CLI).

5. A control system according to any one of the preceding claims, wherein said control system (40) is configured to instruct said means (10) and/or said receiver probe (20) randomize one or more test call parameters.

6. A control system according to claim 5, wherein said test call parameters comprise one or more of the following:

• start time of a test call;

• duration of a test call;

• ringing duration of a test call; and • timing of one or more signalling messages of a test call.

7. A control system according to any one of the preceding claims, wherein said control system (40) is configured to instruct said means (10) and/or said receiver probe (20) to inject content in said test calls.

8. A control system according to claim 7, wherein said content comprises one or more of the foilowing:

• DTMF tones;

• noise; and • speech.

9. A control system according to any of the preceding claims, characterised in that the control system (40) at least partly is comprised within said receiver probe (20).

10. A system (1) for détection of a bypass (540) of an interconnect (530) to a télécommunication network (50), characterised in that said system (1) comprises a control system according to any of the preceding claims, said system (1) further comprising:

• at least one means (10) adapted to originate a test call to a télécommunication network (50) under test from outside the télécommunication network (50) under test; and • at least one receiver probe (20) with a subscription (201, 202) for terminating said test call.

11. A system according to claim 10, wherein said subscription (201, 202) for terminating said test call is configured with calling line identification restriction override (CLIRO).

12. A method for detecting a bypass (100) of an interconnect (30) to a télécommunication network (50) under test, said method comprising the steps of:

• the means (10) originating a test call to said télécommunication network (50) under test from outside the télécommunication network (50) under test;

• the at least one receiver probe (20) with a subscription terminating said test call; and • a control system (40) initiating the test call; receiving from the receiver probe (20) call information comprising a received calling line identification (CLI) of the test call; and analysing the received calling line identification (CLI) in order to detect the presence of the bypass (100) when the bypass (540) is présent during the test call,

-19CHARACTERISED IN THAT the method comprises the further step of the control system (40) instructing the receiver probe (20) to pick up a number of said test calls for avoiding counter-detection by a bypass operator while limiting costs.

5

13. A method according to claim 12, wherein only a number of test calls are picked up by said receiver probe (20) on suspect routes.

14. A method according to claim 13, wherein only between 20% to 70%, preferably 40% of test calls are picked up by said receiver probe (20) on suspect routes.

15. A method according to any one of the claims 12 to 14, wherein whether the test call is picked up by said receiver probe (20) on suspect routes is determined by the analysis of the received calling line identification (CLI).