TR201821141A2 - METHODS AND SYSTEMS FOR PREVENTING INTERACTION FRAUD - Google Patents

Abstract

Methods and systems for prevention of interconnection fraud in a telecommunication ON (Operator's Network) (10), using both real calls of real subscribers and test calls calling to real subscriber numbers. CSNs (Called Subscriber Numbers) of the real or the test calls are controlled by a CU (Control Unit) (11). Incoming Fraud with CLI (Calling Line Identifier) Corruption, Incoming Fraud through National Route, Originating Fraud, and Terminating Fraud are detected and prevented by analyzing RSCs (Route Source Codes) of terminating calls of the CSNs. In Incoming Fraud with CLI Corruption, the fraudsters terminate international calls with lower termination fees through manipulation of caller identifiers or calling party numbers. In Incoming Fraud through National Route, the fraudsters terminate international calls through national interconnection routes. In Originating Fraud, FUs (Fraudster Units) (30) make originating international calls from the ON (10) towards international foreign numbers, exploiting long distance calling tariffs of the ON (10). The FUs (30) carry transit international calls as originating international calls from the ON (10). In Terminating Fraud, FUs (30) make national calls terminating the international calls to subscribers of the ON (10). In Originating Fraud and Terminating Fraud, subscription numbers exploited by the FUs (30), such as "SIM Box" numbers, are prevented.

Description

DESCRIPTION METHODS AND SYSTEMS FOR PREVENTING INTERMEDIATE SCAMS Technical Area Interconnection scams bring massive amounts to telecommunication operators globally causes losses. Telecommunication network operators worldwide They seek effective solutions to the problem.

This invention is the interconnection in the networks of telecommunication operators. It is related to the prevention of fraud, especially the GYKK (The Way Taken) of the terminated calls. It does this by analyzing Source Codes.

State of the Art International calls between network operators via legal interconnection routes they are transported. The quality of the traffic on these interconnections is determined by the interconnection operators. Is controlled. In response to the service of terminating international calls in networks operators charge the operators they interconnect. Using legal interlinks instead, scammers obtain the traffic from other carriers and in a different way at lower cost, They terminate to OS (Operator Network). Thus, a widespread and increasingly global As a problem, scammers steal large amounts of revenue from operators and accordingly States also suffer tax losses. According to the prior art fraud scenario, international calls are made via the Internet. a DB located in the destination country of the scammer usually international calls (Fraud Unit), for example a “SIM Box” or “GSM Gateway”. These calls VoIP (Voice over Internet Protocol) call, Video over IP call, or any other type of IP (Internet Protocol) multimedia session. This DB of the scammer, national SIM (Subscriber Identity Module) of mobile subscriber numbers of operators subscription access interfaces such as cards or a PBX (Private Branch Exchange) or It may have rogue access such as the SlP (Session Initiation Protocol) Trunk line. This DB receives national origins arising over these subscriber access interfaces, whose international calls are exploited. ends the dialed subscriber numbers by making calls. Termination in the prior art Such as Bypass, Bypass Scam, Bypass Interconnects or “SIM Box” Scam Although it has different names, this scenario is in the Network in this invention. It is called Terminated Fraud. In the prior art, fraud numbers used to bypass interconnects Test calls are generated between test numbers for the purpose of detection. However, test calls the presence of unnatural parameters such as caller and dialed numbers in their signaling For this reason, scammers can distinguish these test calls and take action. That's why this methods have become useless over time. In another approach of the previous technique, “Advanced predictive intelligence for termination bypass in a way to make accurate calls to the subscriber numbers of real subscribers and the calling number information is produced to be the real subscriber number. This method scammers effective detection against scammers to some extent, as it makes it difficult for them to distinguish test calls. served as a method. This method of the prior art is primarily used for test calls. uses the methods for generating and then testing this on the OS the solution serves. terminates its calls. Finally, this method is used to obtain ANB (Caller Number) information) differs from the ANB of the generated test call and the numbering of the received ANB country If it is a number within the plan, it detects Network Terminated Fraud. In this technique a system generates, checks and terminates test calls. The method of the prior art can offer a solution to the Fraud Terminated in the Network. revealed This invention has solved some of the problems of Network Terminated Fraud related to the prior art. It also provides solutions to new types of interconnection frauds. This is revealed new interconnection scam solved using inventive methods and systems types, Inbound ANB Scam Scam, Inbound National Road Scam and It Is Fraud Born On The Network.

In Inbound ANB Scam Scam, international calls are normal for operators. they are terminated by international interconnection routes. However, the ANBs of the calls together or the actual applied to the country of origin according to the ANBs received by a trailing fraudulent carrier. corrupted or manipulated to pay an interconnection fee of less than the fee. For example, European Union regulations require higher interconnectivity for traffic from outside the union. applies the fee. The scammers send the ANBs of international calls to the member states of the union. By manipulating or corrupting its ANBs, these calls appear as if they were born from a member state. they show.

Inbound Direction National Road Scam, international calls are interconnected they are terminated from the operators' national interconnection roads instead of using the national interconnection roads.

Since scammers can easily break the ANBs of these calls to their national ANBs, operators can use this interconnection scam simply on international routes via national routes. Making Interceptions impossible by checking for received calls with ANBs is coming. This type of interconnection fraud is especially relevant to the international calls of their regulation. applies to countries where it charges a higher termination fee than for national calls, which is This is a common practice for many countries around the world.

In fraudulent fraud, scammers make international calls over the internet, for example, a “SIM Box” or fixed line subscriber access interface in country A. And this they make international calls. The scenario of the Fraud Terminated in the Network, "SIM Box" was to terminate the subscriber numbers. In the case of Dogan Dogan Fraud, on the other hand, it is different. scammers, telecommunication operators and OTT (Over-The-Top) You/Business Providers exploiting international calling tariffs and campaigns as a result of competition between they are doing. For example, the flat rate calling rate of an operator in country A search service towards country B as well as other countries offered in the campaign Let's assume that country B has a higher termination fee. attractive to scammers. Rather than engaging in a "SIM Box" activity in country B, scammers They take advantage of “SIM Boxes” in country A, which scammers use this fixed price in country A international calls predominantly to country B by subscribing and exploiting the tariff they do. These international calls are for international calling transport to countries such as country B. Due to its high price, it causes a high cost to this operator in country A. It is possible. In this way, scammers leave the cost burden to the operator in country A, while still they also expose customers in both countries to deteriorating call quality.

In the current art, the Network Terminated Fraud is the result of the test call generated by the received ANB. determined by comparison with the original ANBs. In this discovery, to analyze the ANB instead of AAN (Called Subscriber) for detection and prevention of interconnection fraud. Analysis of the GYKK (Source Code of the Way Reached) values related to the terminated calls of is done. The GYKK value of a terminated call consists of three pieces of information: Interconnection partner sending the call, like a national or international road the type of route taken and the operator information of this terminated call that has the subscription of the ANB.

The first major requirement of using the GYKK analysis is that there are two different types of Inbound Fraud. to detect and prevent. In this invention, among other systems, triggers A KB (Control) that processes, generates test calls, detects and prevents interconnection fraud. unit) is available. In Inbound Scam, KB is the incoming call where the terminated call entered the OS. Requires route information. This Path Information gives the KB two information of GYKK, which are It is the type of interconnection partner and interconnection road to which the incoming road belongs.

The second main requirement in using the GYKK analysis is that interconnection fraud is faulty. is to ensure that it can be prevented without detection. In the previous art, we compare the ANBs and Checking whether the numbering schemes are within the national numbering scheme of the country leads to erroneous detections. Fraudulent carriers can receive their ANBs from a national operator in the country normally. is manipulating their ANBs by changing them to subscriber numbers, and this situation allows the operator to This causes it to detect numbers as Fraud Numbers, which can lead to incorrect detections. it leads.

In mobile networks, internationally terminated calls are placed in AD (Interconnection Nodes) to AANs. can be triggered. This is because MAP (Mobile Application Part) SRl (Send Routing) It sends the trigger parameters to trigger the terminated services. However, mobile on non-networked networks, their calls normally enter through their AD, and the AAN's final SD (Service Node) and then these calls are triggered to the terminating services of the AAN.

These non-mobile core networks are NGN (Next-Generation Networks) or PSTN (Public Fixed networks such as Switched Telephone Network and IMS (Internet Protocol Multimedia Subsystem) networks. IMS core networks are essentially both mobile and mobile It serves non-access networks and, over time, modern telecommunications networks are planned to replace legacy CS (Circuit Switched) base networks. This Therefore, it is important to solve this misdetection problem in non-mobile networks. is doing. According to the previous technique, in mobile networks, this control system is The scam is received from an MSC (Mobile Switching Center) of the terminated call OS. can detect if triggered and received with a different ANB. However, thanks to a call from an AD is triggered, then it is concluded according to the different ANB taken. non mobile In networks, this terminated call could be a spawn call in the OS or a legitimate interconnection to the OS. path, transmitted from an AD to SD, and then from this SD to this control system could be triggered. This is the case of the termination between mobile and non-mobile base networks. is the difference in the transmission of calls. In the prior art, this control system is Mains Terminated It decides the fraud based on the ANB* received without the Path Information. First, there is a prior art misdetection problem in non-mobile networks. For example, if scammers assign the ANB to a subscriber number of the OS, then the previous technically this ANB's In-Network Fraud Terminated In Non-Mobile Networks as it detects. In practice, before the operator blocks the detected subscriber number, To ensure that the call is a spawn call in the OS, this terminated call's RDK (Call It should analyze Detail Records. In other case, scammers can use the ANB to other people in the country. can assign it to an ANB owned by an operator. Again, the operator's call actually belongs to the ANB. Checking the CFCs to see if they have been received from the interconnection partner It should be and then it can take action on the ANB.

Second, there is another unresolved scenario of the prior art. It is both mobile and Applies to non-mobile networks. In addition to the additional EQC processing effort for operators, thanks If the interconnection partner of the terminated call is a transit carrier and the fraudster if it does not belong to the assigned ANB interconnection partner but to another national operator, then operators cannot decide on the ANB even if they process the MDK. This problem is due to the previous technique. is another problem. In this discovery, such fraudulent calls are called National Path Inbound. This problem is solved by detecting and preventing fraudulent activity.

Accordingly, one reason for the use of national ANBs for scammers is an obvious undetected with the international ANB, cheaper national routes instead of expensive international routes. to terminate international calls via interconnection routes. This type of scam The direction is called National Road Fraud. This invention revealed is an ANBini, thank you if the terminated call is received in the KB with a GYKK notifying a born call in the OS, on the Network It detects as the Terminated On-Network Fraud Number. And this invention revealed In the NW, with a GYKK declaring a national interconnection path, the call terminated. the operator with the subscription of the received ANB and the interconnection partner from which the call was received If it is the same as , it detects it as the Out of Network Fraud Number Terminated in the Network. count If the subscription of the ANB belongs to another national operator or not to any national operator, in this case, this terminated call is treated as Inbound National Road Scam. OS It can block inbound Scam calls or report them to interconnection partners.

Thus, the analysis of GYKK reveals that OS Terminates in Network for non-mobile networks. Malpractice in On-Network Fraud and Off-Network Fraud Terminated Allows you to remove detections. Additionally, Inbound National Road Scam Terminated Network for mobile and non-mobile networks through detect and prevent It eliminates the problem of detecting Out of Network Fraud. Another problem of the prior art is that the test calls made to the dialed subscriber numbers are During the control period, random calls of AANs fail. However, this risk of random calls being answered by the system that generated the test call instead of the AAN available. This problem is mainly due to the interconnection fraud of the customer experience. prior art, especially for operator networks where lost revenue is as important as is another problem. This invention revealed most of these shortcomings by chance. distinguish subscriber calls from terminating calls of AANs and connect them to AANs by solving it. A possibility that still remains as the risk of random calls failing However, this possibility is considerably reduced compared to the prior art.

Methods with increasing effort for operators to prevent Network Terminated Fraud Because of the call, some scammers First of all, international calls operators are legitimate. ends its international routes. AAN's ringing or even answering then, ending the terminating leg of the call and at the same time holding the nascent leg of the call. On the other hand, it reconnects this call as a fraudulent call. control of AAN By analyzing the GYKK of calls that terminate in real time during the In addition to reducing the risk of answering a random call from interconnections, the invention it adaptively answers the terminated calls of test calls. This adaptive response feature in a way that will reduce the cost of answering the answers given by the KB and the calls that have ended, focuses on terminating calls that are more likely to be alternative routing. Like this, This invention, which has been presented, is an important problem of the previous art. offers a solution to the diversion measure.

In this invention, in order to increase the efficiency in the prevention of interconnection fraud, real calls and test calls are used together. Real calls all over the world are the international calls of the YS (Foreign Network) next to it. These are your real calls KB, using techniques to deliver triggers from YS to OS's KB* check the AANs of real calls and interconnect scam for those real calls detect and prevent. The use of real calls provides significant advantages and the test call solves many problems of the method. However, YSs around the world Ensuring triggers of real calls from across the Because it will take time to make deals, test calls are not compatible with real calls. It will still be advantageous to use them together. This is especially true of the operator's actual calls. It is required for YS's that have not yet been able to provide their triggers.

The main advantages of the real call method over generating a test call are as follows can be grouped: - Increasing cost for operators to generate test calls from networks around the world association and this may not be possible in practice.

- Fraud detection suppliers have limited capacity to generate these test calls they have.

- Speed is very important in detecting fraud. Consequently, in the prior art the test is called They sample real traffic to detect Network Terminated Fraud. For example, even half an hour of use of a "SIM Box" number can scam scammers. By including the numbers in the cycle, he can ensure their survival. This situation it leaves scammers survival space. The real call method is that of a test call. through these numbers, without having to wait for the numbers to match. Allow operators to detect these numbers as soon as fraudulent activity is found. allows.

- Thanks to the use of real traffic, real traffic from these YS gives no room to scammers. it won't let go. However, this true calling method is obtained from YSs around the world. It can be used within the scope of triggers that can be used. - As in the previous technique, the calling and calling subscriber numbers are from real subscriber numbers. even if selected, scammers parsing test calls and diverting traffic in legal directions other parameters of call transport protocols on which algorithms are applied. available. This situation is more suitable for scammers in protocols such as SlP (Session Initiation Protocol). it becomes easy. When using real calls, scammers use this type of Artificial Intelligence. or Machine Learning-based algorithms become dysfunctional.

- During a test call calling for a real subscriber number, you can retrieve the subscriber numbers of these calls. Ending calls are not allowed to be connected to prevent them from ringing. this test risk that any random call during the call will fail in the prior art available. This makes the test call method unsuitable for modern customer-oriented networks. it builds. In real call method, real calls normally connect to AANs. There is no risk of any call being unsuccessful.

- Due to the nature of real calls being answered by their AAN: o There is no risk of answering random subscriber calls. o The alternative redirection measures of the scammers will be in vain. 0 No cost to answer test calls.

- Inbound ANB Spoof Scam and Inbound National Scam using test calls Detection of Road Fraud allows the operator to identify interconnection partners and previous carriers. provides evidence to compel a resolution. However, these are full and deterrent against scammers. does not provide a solution. However, if the actual calls of YS's are triggered to KB, KB is in OS. It can automatically block terminated calls detected as Inbound Scam.

This will prevent fraudulent traffic for triggered real calls and fail to reach the OS. It will cause scammers to lose their traffic because of the calls.

Providing triggers from YS's at the initial stage of implementation around the world, to provide international roaming co-network triggers for mobile networks mobile and fixed telecommunications group companies operating in many countries This can be done practically by providing triggers between networks. even more Importantly, this business case is a win-win opportunity for networks where calls originate and terminate. It has the potential to put an end to interconnect scams because it offers This situation It is based on the fact that the network from which the calls originate is with the network that is the target of the calls. even if it does not mutually implement this anti-fraud method on its own network, When they provide the triggers of their network to the target networks, the outgoing international legally free from interconnection scams of your calls and to high quality destination networks It will make sure that it will be delivered over the interconnection paths.

Figures to Help Understand the Invention Figure 1 is a method for preventing interconnection fraud in line with this invention. It is a demonstration of the method and system.

NT (Number Portability) analysis in line with this invention presented in Figure 2. a method and system for transmitting the triggers of real calls to KBs without It is a related display.

NT analysis via a Leading KB in line with this invention presented in Figure 3 a method and a system for transmitting the triggers of real calls to KBs by It is a related display.

In line with this invention presented in Figure 4, a Central SAF (Signaling Transfer function) to KBs of triggers of real calls by NT analysis. It is a method and a demonstration of the system for the purpose of communication.

In line with this invention presented in Figure 5, NT through an MDB (Central Distribution Unit) A method for transmitting the triggers of real calls to KBs by analyzing and is a representation of the system.

Figure 6 shows local subscriber numbers and roaming subscriber numbers in line with this invention. a method and a system for generating test calls that call correctly is the display.

In line with this invention, which is presented in Figure 7, it is seen that interconnection fraud in mobile networks It is a demonstration of a method and system for prevention.

Figure 8 shows how interconnection scamming in fixed networks is in line with this invention. It is a demonstration of a method and system for prevention.

In line with this invention, which is presented in Figure 9, it is possible to determine the interconnection fraud in IMS networks. It is a demonstration of a method and system for prevention.

Figure 10 interconnects with the analysis of GYKKs of AAN in line with this finding. This is a flowchart of a method for fraud detection.

Explanation of Reference Numbers in Figures : OS (Operator's Network). 11: KB (Control Unit). 12: AD (Interconnect Node). 13: SD (Service Node). 17: Radio Base Station.

: Subscriber Access Interface. 21: TB (Supplier Unit). 22: YS (Foreign Network). 23: International Signaling Carriers. 24: MDB (Central Distribution Unit).

: International Traffic Carriers. 27: Internet.

: DB (Scam Unit). 31: TÇUS (Test Call Generation System) 32: NT (Number Portability) Database. 33: Central SAF (Signaling Transfer Function). 34: ENUM (E164 Numberto Universal resource identifier Mapping) Database.

: HLR (Home Location Register). 36: UDOS (International Roaming Partner Network) 40: Chosen Carrier 41: Next Carrier 42: User Device 43: HSS (Home Subscriber Server-Local Subscriber Server). 44: P-CSCF (Proxy-Call Session Control Function). 45: l-CSCF (Interrogating-Call Session Control Function - Inquiry-Call Session Control function).

Detailed Description of the Invention Summary of detailed description It is in this invention that is revealed. a KB (11) AAN (Called Subscriber Number) of resource calls checks. These resource calls can either be triggered as triggers from TB (21) or KB They can be generated by (11) as test calls. TB (21)'s around the world YS They can be (22)'s that these YS (22)'s can make their international calls to OS (10)'s KB (11) as triggers. Alternatively, TB (21)'s are different from the country of OS (10) They can be KB (11) from countries. Or, TB (21)'s are different from OS (10)'s subscriber numbers. Any TÇUS (31) can call international foreign numbers. OS as AANs The resource called, which has the subscriber numbers of (10), is responsible for Inbound Fraud and It is used to detect the Fraud Terminated in the Network. Internationally as AAN'I source calls with numbers are basically for the detection of Fraud Born in the Network. used. Triggers of TBs (21) are collected in an MDB (24) and these MDBs (24) are stored in OS (10) It triggers KB(11)s centrally. Alternatively, you can directly convert TB (21) to KB (11). they can trigger.

In another aspect of this present invention, we use KB (11) resource calls as test calls. produces. It can directly generate test calls using signaling and carrier protocols. as well as KB (11) can generate test calls via TÇUS (31)'s. OS(10)'s subscriber Calling test numbers, Inbound Fraud and Network Terminated They are used to detect fraud. Active visitor international roaming test calls calling the subscriber numbers belonging to the subscribers, are used for detection.

Figure 1, after international calls are triggered from a TB (21) or a test from a YS (22) After it is generated as a call, it shows the termination paths in OS (10). TB (21)'s or YS (22) forwards these international calls to the International Traffic Carriers (25). First In normal case, International Traffic Carriers (25) call these terminating calls to an AD of OS (10). It terminates via the interconnection paths in (12). These terminated calls, Inbound It can be detected as fraud or as normal ending calls. In the second alternative, One of the International Traffic Carriers (25) is a carrier over this called internet (27). What does the DB (30)*forward that DB (30) calls these calls to Scam or Network Terminated? Dogan Terminates AANs as Fraud.

During the control of the AANs, the terminating calls of the AANs are controlled by the KB (11).

KB (11) determines the GYKK (Source Code of the Way Reached) of the terminated calls and sets them Matches with these AANs throughout the control of their AAN. In one aspect of this invention, during this check, via triggers of terminating calls received from GYKK's OS (10) they are obtained. KB (11) controls the AAN's terminating calls through these triggers.

In another aspect of this present invention, during this control, GYKKs, OS (10), from CDK Network RECs for these terminated calls received as (Call Detail Record) flows are determined through Therefore, KB (11) sends AAN's terminating calls to OS (10)* for this the network controls it through the IDK's.

Terminated call, if received from an internal native path of OS (10) and if origin call If its AAN is a subscriber number of OS (10), this terminated call In Network Terminated In Network Fraud and ANB of this terminated call On-network Fraud Terminated in Network It is identified as a number. Terminated call, if OS (10) is from a national interconnection path if received and if this terminated call's subscription to the ANB is forwarded to the interconnection partner from which the call was received. If so, this terminated call is identified as Terminated Off Network Fraud, and the ANB of this terminated call is the Out of Network Fraud Number Terminated in the Network. detected. Terminated call, if received on a national interconnection path of OS (10), and if If the ANB subscription of this terminated call does not belong to the interconnection partner from which the call was received, Incoming The direction is determined as National Road Fraud. Terminated call, if an OS (10) if received from the international interconnection path, but lower than the original ANB of the source call Inbound ANB Scam Scam if received with an ANB stating an interconnection fee is detected. Terminated call, if received from an internal native path of OS (10) and if If the AAN of the resource call is an international foreign number, Network Born Fraud and the ANB of this terminated call is the Fraud Number Born in the Network. is detected.

These Detected Fraud Numbers detect interconnection fraud in real time. They are automatically blocked by KB (11) to block them. using test calls Terminated calls detected as Inbound Fraud, interconnection partners it would be challenging for them to fix their traffic redirects with their previous carriers. Besides, KB (11) Real time calls of real calls detected as Inbound Fraud which can prevent fraudsters, which provides a more deterrent and complete solution.

Triggers of TB (21)*s on resource calls KB (11) uses the concept of resource calls, which resource calls are either real subscribers calls or test calls looking for real subscriber numbers. This invention revealed In one respect, TB (21) is the source of triggers for real calls. For example, an YS (22)* when a real subscriber makes an international call, this YS (22) will make this real call to OS Triggers KB (11) of (10). Here, this TB (21) is these YS (22) around the world, and these source calls are the real calls that are the international calls of these YS (22).

In another aspect of this present invention, these TB (21)'s are other than the country of OS (10). they are the KB (11) of the countries. These resource calls are KB(11)'s OS(10)'s in these other countries born are real calls with international calls. In these other countries, operators' networks configured to trigger all inbound international calls to their own KB (11) they have been In this way, operators or service providers for fraud prevention In accordance with agreements between providers, operators and service providers, different They can share triggers between KB (11) from countries. NW (11)* of other countries supplied resource calls can contain all resource calls of KB(11), which resource calls The calls are not only real calls, but also test calls produced by the KB (11) of these other countries. covers. Most of the test calls produced by these other KB (11) Although it will make calls to foreign numbers, the triggers of these test calls collection can be used for the detection of Online Fraud in KB (11).

Resource calls with actual calls of YS (22) or test calls of other KB (11) not angry. Resource calls can be made from any third-party service, network, or a TCUS. (31) which can be triggered by TÇUS (31) or even for a purpose other than fraud detection. may be generating calls. KB (11) in OS (10) interconnects the call information of these test calls It can be used to detect fraud. For example, TB (21) can be any TCUS (31) which is TÇUS (31) belonging to different countries around the world from YS (22) all over the world. generates accurate test calls to real subscriber numbers. These TÇUS (31) test calls, test Produces probes from around the world using robots or search services.

This trigger between TB (21) and KB (11) is a communication regarding call information. This communication is the sending of a start message or a start message and at least one includes sending the subsequent message. This initial message for this trigger contains this call information. This call information includes AAN, ANB, country code of the YS (22) of the actual call, real the operator code of the YS (22) of the call, the start timestamp of the start message, or contains the time zone of this timestamp. This subsequent message of this trigger sends the call information. This call information includes at least one or more of the AAN's ring notification, real It contains the notification of the answering of the call or the notification of the end of the actual call. Besides such general communication of call information, triggers are telecommunication networks may also have standard communication protocols. To trigger a real call, this INAP (Intelligent Network Application Protocol) or CAMEL (Customized Applications for Mobile network Enhanced Logic) signaling protocol. IDP (Initial Detection Point) initial message of triggering also in protocol KB (11)'s SCCP (Signaling Connection and Control Part) sent to GT (Global Title) where KB (11) works as an SCF (Service Control Function). Ringing about the status of the real call, other subsequent call information such as answer and termination events They are forwarded to KB (11) via protocols. dialed using the INAP or CAMEL protocols. number series-based triggers are available and widely used in fixed and mobile networks. they are used. To be sent to the defined SCCP GT destination address of TB (21), KB (11), can configure any dialed number sequence to be triggered. For example, of KB (11) depending on the country or operator number series, a YS (22) as TB (21) this number series to KB (11) in trigger configurations of YS (22) can.

This is the difference between the number sequence based triggers and the CAMEL triggers in international circulation. It is useful to clarify the difference. For example, real calls originating in YS (22)'s networks They trigger based on the dialed target country or operator number series. As a result, mobile YS (22)'s, in addition to the calls of their subscribers, international roaming in their networks They also trigger international calls of their subscribers. By the way, which subscriber these triggers Since they are independent of the caller but dependent on the number sequences dialed, triggers independent of the CAMEL signaling communication of the international roaming subscribers. This communication is not number series based triggers, but O-CSI (Originating - CAMEL) of the protocol. Subscription Information) feature.

With the convergence of fixed and mobile networks, IMS (IP Multimedia Subsystem) networks centrally serve different access networks. Accordingly, SIP (Session Initiation Protocol), as well as IMS-based YS (22) Also for triggering of NGN (Next-Generation Networks) based YS (22) can be used. The trigger's INVITE start message is a defined one on their IMS-based TB (21) An Application Server of KB(11) configured as Application Service parameter It is sent on your behalf. The real call in TB (21) is the subscriber number of an international destination. calls, this Application Service becomes active. Triggers an Application on IMS networks In addition to identifying as a service, any network that supports SLP such as IMS or NGN networks flexible number-based on a network, access or gateway SBCs (Session Border Controller) You can also send SIP INVITE messages to multiple destinations using routing configurations. can trigger. This is exactly CS based telecommunications using INAP or CAMEL Similar to the number sequence-based triggers configured in networks.

MAP (Mobile Application Part) SRI (Send Routing Information) dialog, mobile type YS From (22) to KB (11) there may be an option as triggers for call information. MAP SRl The message is sent to SCCP Called Party GT according to GSM (Global System for Mobile) standards. It can constitute an initial message sent to its AAN. SRI message about resource call when the AAN's terminating call is received in OS (10), even though it is not transmitting the calling party's ANB OS (10) can still prevent interconnection fraud.

Communication between TB (21) and KB (11) of OS (10) can be in two ways. First, a TB (21) and It is direct communication between KB (11); where TB (21)'s are any of the aforementioned uses the trigger method. In direct communication, TB (21) triggers any target to which it will deliver. must configure the networks. As a more practical approach, another method is TB. It is the central communication where (21)'s trigger real calls to an MDB (24). And MDB (24), real Triggers calls to one or more KB (11) of OS (10). Central communication, TB (21)'s and It simplifies communication for OS(10)s, because TB(21)s have a device to trigger spawn calls. agree with the operator or configure any target network KB (11) changes, they do not have to change their own configuration. Instead, MDB (24) triggers, in accordance with bilateral or unilateral agreements between other operators. they can share.

Bilateral or reciprocal agreements benefit both TB (21) and OS (10). YS (22)'s, real calls will be carried over legitimate interconnect paths to the target OS (10) they make sure of it. For these YS (22)'s, the outbound international for which they pay the full cost It is an important motivation for the quality of the calls to be carried over the legal interconnection routes. Aim operator both prevents interconnection scam and for terminated international calls provides a better quality. In case both parties trigger each other for their real calls, It provides maximum benefit to both parties.

As for the security and privacy of call information such as AANs and ANBs, the messages of the triggers End-to-end encryptable and secure International Signaling Carriers (23), VPN (Virtual Private It can be done over network connections or over secure internet (27) connections. Local or considering the safety regulations of regional regulatory agencies, the call security and privacy standards for the communication of information, for example the European Union's GDPR (General Data Protection Regulation (General Data Protection Regulation) can be easily implemented.

By making agreements with OS (10) and MDB (24), operators or TB (21) providers can control which OS(10) their call information is shared with. This agreements, source and destination networks related to regulatory, security and privacy adapts to their needs. As well as operational efficiency, use of MDB (24) It also provides convenience in terms of security and privacy. MDB (24) regional and local regulations OS (10) provides the advantage to centrally carry out harmonization.

Triggers/transmission methods of TB (21 ) If the source calls have AANs containing the country code of the country of OS (10), then triggers of these real calls are forwarded to the OS (10) in the country to which their subscription belongs. A These triggers, which make calls to local subscriber numbers in the country, They are used to prevent fraud and Inbound Fraud. This local subscriber numbers are the subscriber numbers of the real subscribers of OS (10).

Sending these triggers to the KB (11) of the OS (10) to which the subscription belongs, there are various alternatives. method can be accomplished. As shown in Figure 2, one of the methods is TB (21) or MDD. (24) triggers KB (11) of each OS (10) in a country, using multiple triggers. This is a For each new KB (11) that has just started to serve in the country, this is the case of YS (22) or MDB (24) means they will update the trigger settings to trigger the new KB(11). This trigger In the method, the KB (11) of each OS (10) in the country is the KB (11) of all actual calls to the country. they get their trigger. Then a NT of KB(11)'s via an NT Database (32) By performing a (Number Portability) query, you can find the OS (10) that has the subscription of its AAN. needs analysis.

In another method, again according to Figure 2, TB (21) or MDB (24), KB (11) of each OS (10) can only trigger for OS (10) own number sequences. In this case, OS(10)'s KB (11) are those using the original subscriber numbers of other national operators in the country and they do not receive triggers of migrated subscriber numbers. Subscription of AAN of sayet trigger, according to the NT query made, if they belong to OS (10), the KB (11) in the country still have their own OS (10) fraud prevention method for AANs using their original subscriber numbers can apply.

As a solution to the number portability problem, the OS with the subscription of the triggers (10)'s either to TB (21)'s or to OS (10)'s with subscription determined by MDB (24) must be transmitted. Accordingly, in another alternative method, as shown in Figure 3, triggers are a Pioneer OS (10), which is the OS (10) to first implement KB (11) in the country. It is sent to KB (11). KB (11) solution, as a follower of this Leading KB (11), a new one in the country In case OS (10) also starts to implement, TB (21) or MDB (24) this new follower It triggers the follower KB (11) of OS (10) only for its own number sequence, while all other the number sequences are still triggered to the Leading KB (11). A solution to the NT problem Finally, when the Lead KB (11) and the follower KB (11) receive the start messages of the triggers, Makes NT queries for AANs using the NT Database (32). In response to NT queries, a If they detect an exported subscription, they will send their Lead or follower KB (11) to that startup. they send their messages to KB(11)* of OS(10)s which have subscription of AANs. This Thus, each OS (10) implementing the KB (11) solution makes calls to its subscribers. is triggered for resource calls.

In another alternative method, as shown in Figure 4, the OS with the subscription in the country A Central SAF (33) has been proposed for the detection of (10). Triggers, this Central SAF in the country the OS that has the subscription directly to the start messages of the triggers It transmits (10)'s to KB (11)'s. Central SAF (33) KB of OS (10) with subscription NT over an NT Database (32) for AANs of triggers to detect (11) performs queries. To select the appropriate NT solution among the alternatives, operators must The appropriate method can be determined by considering the regulatory needs. For example, Central SAF (33) an operator in a country or a licensed operator under the control of the country's regulator. may be operated by the contractor. Or regulators can provide a Central SAF (33) solution. They may not recommend but encourage multi-trigger or Pioneer OS (10) solutions.

In the case where MAP SRI messages are used for triggers, the SCCP of the SRI start message calling party address is assigned as AANs of real calls according to GSM standards. This situation SCCP address conversion in methods using a Pioneer OS (10) or a Central SAF (33) problematic pantry. SCCP caller address of MAP SRI messages triggers to Lead OS (10) In order to be able to send it, it is converted to the SCCP GT address belonging to the KB (11) of the Leading OS (10).

However, triggers of any other KB(11) are still AANs of real calls. It continues to be triggered to SCCP addresses that have been assigned as Similarly MAP SRI The SCCP caller addresses of the messages are converted to the SCCP GT address of the Central SAF (33).

As an alternative to the transformation in the centralized SAF (33) solution, each operator in the country He sent the MAP SRI messages he received from the International Signaling Carriers (23) to this Center. It can forward it to the SCCP GT address of SAF (33). SCCP address conversion of SRI messages, say If direct communication between source and destination networks is used, TB (21) MDB (24) in signaling gateway function or if using synchronous communication can be performed by

In the case of using optimum call forwarding between a mobile OS (22) and OS (10) normally SRI messages may be transmitted between international roaming operators. 3GPP (3rd Generation) The SOR (Support of Optimal Routing) feature defined by the Partnership Project allows calls to be go to the subscriber's own network and from there to YS (22) where the subscriber is actively roaming calls are made locally to the international roaming subscribers of OS (10) without having to it allows it to be connected. An SRI message from an YS (22) to OS (10) for a nat call is sent, and OS (10) sends an MSRN (Mobile) that directs YS (22) to establish the call locally. Subscriber Roaming Number) is returned in response. For triggering SRI messages If used, both YS (22) and OS (10) will enable this ASK feature on their networks. if they support it, OS (10)'s KB (11) will send the received MAP SRl start message to AAN's HLR (35). KB (11), SRI received whether an YS (22) supports SOR understands using an ASK parameter in the message.

As an alternative solution to the NT problem, MDB (24) or TB (21)s can be used to trigger KB(11)s. as well as they can take on the role of identifying OS 10s that have subscriptions to triggers. Shape As shown in MDB (24) or TB (21) if the OS with the subscription (10) KB (11) the OS that has the subscription, the start messages of the triggers. It redirects (10)'s to KB (11)'s.

There are alternative methods for detecting the OS(10) that has the subscription. Of the alternatives one is HLR (35), ina MAP SRl-SM of the operator, which has the number series of its AAN in the country. (Send Routing Information for Short Message) operation. NT in the country Depending on the application, this will either return the operator code of the subscribed OS (10) or it also gives a reply from the HLR (35) of the operator that has the subscription to the MDB (24) or TB (21).

Configure operator codes or operators' SCCP Caller Party Address using the MDB (24) or TB (21) determines the OS (10) that has the subscription, and then the OS or MDB (24) sends the start message of a trigger to the KB of the OS (10) that has the subscription. (11) sends it.

In another alternative, MDB (24), NT over NT Database (32), as shown in Figure 5 It directs the triggers to the OS (10) that has the subscription by making the queries. a country or an operator in the country can access this database. However, as shown in Figure 5 such as, in another alternative, the MDB (24) can be connected to an ENUM Database (34) for AAN and an ENUM (E164). OS that has subscription triggers by performing a Number to URI Mapping query (10) directs to. This query returns the URI (Universal Resource) of the OS (10) that has the subscription. Although it shows (24), TB (21)'s can also be subscribed to AAN by using these methods. they can identify the OS(10) having it. For example, in practice, OS (22)'s have subscriptions for many countries and operators. It may be impractical for (10)'s to trigger or detect BP's (11)'s. In other words, TB Direct communication between (21)'s and KB (11)'s, compared to triggering via MDB (24) may seem unnecessary. However, considering the operators of a telecommunications group Take into account that TB (21) can also be a KB (11) of other countries, when resource calls made directly from TB (21) to KB (11) triggering can be a logical and practical option.

Beyond getting triggers for OS(10)'s own subscriber numbers, OS(10), TB To receive the international caller triggers of (21)'s, to MDB (24) or register to their TB (21). These triggers are Networked by KB (11) of OS (10) It can be used to prevent fraudulent fraud. Through these triggers, KB (11) resource can check the AANs of its calls and have those calls spawn in OS (10) of KB (11) can determine whether it was born as international calls. Possible future from YS (22) due to the high amount of triggers, which are triggered by many various international foreign makes accurate calls to numbers, OS (10), detecting Network Scam may need a limited sampling of these triggers. Therefore, MDB (24) TB (21) or KB (11) set a predefined rate of these triggers to an amount that KB (11) can handle. may prefer to filter in an annoying way. Restricting the amount of triggers, On Mains Dogan It can be adjusted in KB (11) adaptively, depending on the detection of fraud. According to this, KB (11) will also set triggers to adjust triggers according to processing capacity. may limit the amount. Destination countries or destinations of resource calls to be triggered in KB (11) select operators. The reason for this is that the occurrence of In-Network Fraud, other some selected country or country that imposes higher termination fees than destinations is a considerably higher probability towards operators. This is also the trigger it gets to OS(10) It also helps in managing the amount.

Generating test calls In another aspect of this invention, KB (11) is accurate to selected real subscriber numbers. generates caller source calls as test calls, which are selected real subscriber numbers they are local subscriber numbers or roaming subscriber numbers. Local subscriber numbers OS They are the active subscriber numbers of the real subscribers of (10). My roaming subscriber numbers, which are the subscriber numbers of real subscribers of UDOS (36) of OS (10) and OS (10) are the subscriber numbers that are actively roaming internationally. AAN local subscriber When selected from the numbers, the test call will indicate Inbound Fraud and Network It is used to detect the Terminated Fraud. AAN is selected from the roaming subscriber numbers. time, the test call is used for detecting Online Fraud. KB (11) test You can generate the generation of calls either using direct signaling and carrier protocols or using a This is done by communicating with TÇUS (31).

KB (11) will be compatible with YSO (Foreign Network Origin) and selected YSO for test calls In this way, it selects an ANB from the real subscriber numbers. Selected YSO test call Specifies the YS (22) from which it will be generated. The selected ANB is a numbering plan of the selected YS (22) It has a series of numbers. In other words, in the country of origin due to number portability. even if any operator can use these numbering schemes, the number sequence of the ANB It is selected to remain in the original numbering plan of the selected YS (22).

In a method of generating test calls, as shown in Figure 6, KB (11) generates its calls using a TÇUS (31) that TÇUS (31) test calls from the selected YS It produces test probes from (22) using robots or search services. KB (11) test While sending requests for the initiation and termination of calls to this TÇUS (31), TÇUS (31) also Reports ringing, answering and ending information of test calls to KB (11).

As shown in Figure 6, another method of generating test calls is KB (11), directly generates test calls using signaling and carrier protocols. Produced test as outgoing international calls from AD (12) to one or more Selected Carriers (40) is transmitted. Alternatively, KB (11) can also send test calls directly to the Selected Carrier (40). can transmit. This Selected Carrier (40) receives these test calls to the selected Next Carriers (41) transmits. At this point, for each Next Carrier 41, the Selected Carrier 40 maintains a list of YSOs that this list indicates from where this Next Carrier (41) is carrying traffic. And this Chosen Carrier (40), if one of the Next Carrier (41)”s list the ANB's YSO of the test call this selects the Next Carrier (41). In this method, test calls are actually (22) they do not come from. In contrast, test calls are returned from Next Carriers (41) while returning, this method will save International Traffic all the way up to OS(10). It allows test calls to pass through many common paths of its carriers 25 . This method It is quite possible to sample the international traffic passing through the International Traffic Carriers (25). It helps.

Produced from a selected YS (22) through a TÇUS (31) or a selected Regardless of whether it is produced from a Chosen Carrier (40) from YSO, AAN is a When there is a local subscriber number, the test call is normally back to OS (10) legitimate. It is expected to be transmitted back over the interconnects. Even if it comes from the interglands termination can also be an Inbound Scam. However, International Traffic Carriers Whatever a carrier call (25) transmits to a DB (30) over the internet (27), then this DB (30) concludes this test call as a national call born towards AAN. DB (30), a of mobile OS (10) via a Radio Base Station (17) or of a non-mobile OS (10) makes calls over a Subscriber Access Interface (20).

Similarly, as shown in Figure 6, from a selected YS (22) through a TÇUS (31) produced or produced from a Selected Carrier (40) from a selected YSO regardless of whether the AAN is a roaming subscriber number, the test The call is normally expected to be forwarded to the UDOS (36) of the AAN. However, International Traffic If a carrier from among its carriers (25) forwards the call to a DB (30) over the internet (27), in this case, this WB (30) is born into the AAN for the purpose of Fraud Born in the Network. makes international calls. Normally OS (10) sends this international call to this roaming subscriber. directs as an outgoing international call to the correct number. Or OS(10), called It can connect the call to the roaming subscriber number by using the optimum call forwarding feature.

The DB (30) can be used by a mobile OS (10) via a Radio Base Station (17) or a non-mobile It makes calls over a Subscriber Access Interface (20) of the OS (10).

KB (11), in OS (10), to prevent the test call from ringing the local extension number Checks the AAN's terminating calls. KB (11) indicates that the local subscriber numbers of the OS (10) because they have their own subscribers. If resource calls, OS (10)'s local If they are triggered from TB (21)” as in real calls looking for their subscribers, then Since these calls are real terminating calls of the AAN, KB (11) is the AAN's terminating calls. continues.

In order to detect Online Fraud, KB (11) test calls, OS (10)`s which are the subscriber numbers of real subscribers of UDOS (36)'s and active in OS (10) It can generate international roaming, roaming subscriber numbers to call.

Similarly, KB (11) causes the test call to ring the roaming subscriber number. It checks the AAN's terminating calls in OS (10) to prevent it. On the other hand, KB (11) It also receives triggers of TB (21) calling international foreign numbers. NW These international dialed numbers of (11) are international calls that are born on OS (10) This time, this time, although he checked them as AANs, to see if they were international foreign numbers KB since OS (10) does not have its own subscriber numbers (11) is not required to suspend or continue calls that terminate to these numbers. there is none.

Test call KB (11) calling the roaming subscriber number, as shown in Figure 6 and AD (12) forwards the test call to an International Traffic Carrier (25).

Alternatively, the KB (11) can request a TÇUS (31), and send this TÇUS (31) test call to a YS. (22) so that YS (22) forwards the call to an International Traffic Carrier (25).

In the case of normal operation of the AAN, the UDOS (36) of the AAN receives these test calls from incoming international They receive calls from International Traffic Carriers (25). Searched roaming subscriber because the number is currently in circulation in OS (10), UDOS (36) queries the HLR (35) of the subscriber number and sends this incoming call to the HLR (35) OS (10) an MSRN (Mobile Subscriber Roaming Number) transmission sends a PRN (Provide Roaming Number) message to request a number.

In order to receive incoming PRN messages in KB (11), PRN messages from UDOS (36)'s OS At (10), it is transmitted over KB (11). If KB (11) has received a PRN message for AAN and if KB (11), if an international call has not yet been associated with the AAN in OS (10), this is the case. test call reaches destination UDOS (36) via International Traffic Carriers (25) It means. Sayet KB (11), before obtaining a PRN for AAN, for AAN or sought If a related international call is determined for the Roaming Subscriber Number, this situation Forwarding a carrier's test call to UDOS (36) from the International Traffic Carriers (25) instead of a DB (30), it means what it transmits. And this is in OS (10) of this DB (30), a Radio An international call originating from the Base Station (1?) or a Subscriber Access Interface (20) means he did. Whether or not a falcon is associated with the AAN of the international call KB (11) terminates the test call and continues the MAP PRN message for the AAN to OS (10). it makes. The reason for continuing the PRN message is that if the PRN message is UDOS If it was sent for a random subscriber call other than (36) and the test call If it had arrived before the PRN, then this random subscriber call would be The call continues to be established without causing the call to the roaming subscriber to fail. would.

Briefly, in this test call generation method, Network Dogan Fraud detected through test calls calling numbers. These test calls TÇUS (31) they can be started from YS (22) using TÇUS (31) It can initiate test calls from (22). These test calls International Traffic Carriers (25) They can be forwarded to a DB (30) by a carrier from within. Or these test calls are from KB (11) directly to the Selected Carriers (40) and then to the Next Carriers (41) respectively it can be started to go. And the Next Carrier (41) or any other carrier this test can forward its call to DB (30).

DB (30) cannot know that AAN is the subscriber number of an active roaming subscriber in OS (10), but only by exploiting OS(10)'s advantageous international calling directions, thinks of it as a destination number to which the call should be reached. DB (30), “SIM Box” numbers or PBX (Private Branch Exchange) lines, SlP Trunk lines, fixed subscriber lines may use various types of access, such as fixed Subscriber Access Interfaces (20). Thus KB (11) determines the ANB of this originating international call as the Detected Fraud Number.

In another aspect of generating test calls, KB (11) is directly connected to the UDOS of OS (10). (36) to the subscriber numbers of the test SIM (Subscriber Identity Module) cards. generates test calls that make a call. Iocation by KB (11) for this each subscriber number update is performed. This subscriber number is selected in accordance with the selected YSO. which is YSO's own network of this selected subscriber number. test calls Similar to generating roaming Subscriber Numbers, as shown in Figure B. For AAN of test SIM card via International Signaling Carriers (23), in KB (11) A PRN message is received from UDOS (36)). This subscriber number is a VLR (Visitor Location OS (10), PRN, since the location update has been made in KB (11) as the register send messages directly to KB (11)* without the need for a special routing configuration. it delivers. Subscriber numbers of test SIM cards can be detected by fraudsters and can be transmitted over normal interconnects. For this reason, these test calls It is not expected to end with the detection of fraud. KB (11) a local subscriber as an MSRN number which sends back the received incoming international call of UDOS (36) to International It causes it to forward back to the OS (10) via the Traffic Carriers (25), which It means making a test call as AAN to the local subscriber number. In this way KB Test calls calling local subscriber numbers selected from (11), UDOS (36) it has produced. These test calls indicate Network Terminated Fraud or Inbound They are used to detect fraud.

Figure 6 also shows another aspect of test SIM cards regarding the use of subscriber numbers. shows. In order to detect Online Fraud, International Via Signaling Carriers (23) a for the AAN of a test SIM card selected in KB (11) When a PRN is received from UDOS (36) KB (11) selects a roaming subscriber number and returns the number as an MSRN. Differently this time, this roaming subscriber sent number is selected from a different country than the UDOS (36) country of the selected test SIM card. This In this way, the test call is sent by UDOS (36) towards International Traffic Carriers (25), in a different way. An outgoing international calling to the selected roaming subscriber number of UDOS (36) routed as a call. In this way, a test call can be made from a selected UDOS (36) as an outgoing international call to its own network of the roaming subscriber number transmitted. These test calls generated between different UDOS (36) of OS (10) It can be used to detect fraud. For example in International Traffic Carriers (25) If a carrier forwards the call to a DB (30) over the internet (27), the call will be a Radio Base instead of forwarding the roaming subscriber number to its own network. via OS (10) via a Subscriber Access Interface (20) of the Station (17) or DB (30) An attempt can be made to transport a falcon as an international call. UDOS (36) MAP PRN messages are transmitted over KB (11) in OS (10). So a Roaming Subscriber When a MAP PRN message is received for the number KB (11), it terminates the test call and then KB (11) continues the received MAP PRN message to OS (10).

Adaptive Generation of Test Calls' In Born-On-The-Net Fraud and In-Network Scam, scammers use a SIM card. If they use the box number, for example, even for half an hour, they can survive.

The scammers continue the scam by including new "SIM Box" numbers in the loop. they can. In particular, the capacity of the KB (11) and TÇUS (31) or the budgets of the operators, It may be limited to generate plenty of test calls from various YSOs. Therefore, time on a dynamic basis, test call sources are trying to detect interconnection fraud. Focusing on YSOs from which OS(10)s are started is to maximize the OS(10)s from these test call resources. It allows to provide benefits and leave minimum space for scammers. Therefore, the test Invited, Based on YSOs Originated Fraud, Ended in Network Fraud and they are produced adaptively, in line with their detection as Inbound Fraud.

According to the method, KB (11) determines the daily total number of test calls to be generated and this calculate the number one day in advance in proportion to the incoming international traffic data in OS (10). distributes it over defined equal time intervals. This is for each time period, for each YSO A defined YSK (Foreign Network Quota) is determined. These predefined YSKs, international traffic data for each time period in proportion to the daily traffic from YS (22) The number of test calls to be made from your YSO.

For each new time zone and each YSO: KB (11) adaptively determines a new YSKtsi. KB (11), as interconnection fraud of at least one of these test calls during the previous time period If it is determined, the value of the determined YSK for the previous time period is determined. increases at a defined rate. KB (11) indicates that none of these test calls during the previous time period from the previous time period, if not detected as interconnection fraud. Decreases the specified YSK value by a predefined rate. In a period of time this determined YSK's is a predefined minimum and maximum value of each YSO's pre-defined YSK. may vary between

Adaptive processing of TB (21) triggers The processing capacity of KB (11) is the number of calls from certain TB (21) to certain destinations. Needs to prioritize triggers. Resource calls of KB (11), TB (21), TB YSD (Foreign Network) In accordance with the detection of interconnection fraud on the basis of destinations, operates adaptively. YSD in determining a YSO before selecting the ANB of a test call and in the selection of this ANB in accordance with the numbering scheme of this selected YSO determined in a similar way. International foreign searched source calls YSDs of international numbers according to the number series of international foreign numbers KB (11) determined by. For example, + <Country Code> For a dialed international number as in the format KB (11), the number of the dialed number YSD*, the <Country Code' obtained from the number and can be determined by matching country or operator codes. For example, if a DB (30) receives international calls originating from a YS (22) which is a YS (22) TB is (21) and these calls are calling towards a YSD, this DB (30) is born in OS (10) makes international calls. KB (11) Identified the ANB of these international calls When it detects as Fraud Numbers, KB (11), this TB (21) and YSD from the pair adaptively increases the number of triggers processed. This effectively removes KB (11)'s interconnection scam. and helps to detect it quickly. Because KB (11) is this TB where fraudulent traffic starts (21) and will increase the density of triggers processed for YSD. Born On The Network Fraud Given the only certain destinations with higher termination fees than other destinations. may be occurring towards the YSDs related to the destinations. Terminated in Mains In Fraud and Inbound Fraud, for subscriber numbers of OS (10) of KB (11) Since it is triggered from TB (21)'s, YSD will be OS (10)'s own destination.

According to the method, log that should be processed as triggers from KB(11), TB(21) determines the number of resource calls in total. And this number is the default equal time of a day. distribute into slices. This distribution is taken in the relevant time zones during this day of the week. It is done in proportion to the average number of triggers. This is for each time period, this total number this distributed value in proportion to the number of triggers received in each TB (21) and YSD pair, They are divided into TBK (Trigger Unit Quota) values. These TCO values are defined as the default TCOs. are recorded which are the default TBKs that are each TB (21) and YSD for each time period is the number of source calls to be processed from pairs.

For each pair of TB (21) and YSD in each new time slot, KB (11) adaptively generates a new TBK determines. KB (11) this is the TBK determined for the previous time period, so this is the previous time period. At least one of the resource calls in the time period is detected as interconnection fraud. If set, it will increase adaptively at a predefined rate. And KB (11) this is the previous time period provided that none of the resource calls were made in this previous time period. if not detected as interconnection scam, it will adaptively at a predefined rate. reduces. TBK, TB (21) and YSD, which were determined as adaptive in this time period, are the pre-defined between two values of TCO determined by a predefined minimum and maximum ratios. it can change.

Collection of real subscriber numbers for test calls KB (11) displays the recently used real subscriber numbers periodically in OS (10). collects and updates a pool of numbers to be selected for test calls. Dogan in the network This is the nature of OS (10) that can be triggered from OS (10) to KB (11) for fraud detection. using the triggers of these international calls, caller numbers of triggers, so this caller number is a visitor roaming If they do not belong to the subscriber, they are collected as local subscriber numbers. These calling numbers are a Since they are looking for an international destination, they are also likely to receive international calls. is high. Scammers maintain blacklists of called party numbers, which is called party numbers. numbers are often the test operators use to detect interconnection scams. are numbers. The reason for collecting these numbers is probably because scammers is to choose the real subscriber numbers in the lists. Similarly, this born Calling party numbers related to the triggers of international calls, so this caller If the number belongs to a visiting roaming subscriber, it is collected as the roaming subscriber number and used. For similar reason, to select ANBs from real natural numbers, this using the triggers of the international calls, called party numbers as ANBs. is collected.

The subscriber numbers of the terminated international calls are also collected and stored in the number pool.

AAN's and ANB's, OS (10)'s own subscribers' international incoming calls CDK (Call) Detail Records)*. These numbers are updated in this number pool where AANs are kept as local subscriber numbers. Similarly, roaming subscriber numbers They are collected from the CDKs of the visitor roaming subscribers in OS (10). CDCs of OS (10) can be obtained from the charging system or the signal monitoring system. This is real subscriber numbers may be collected from RDKs by a process of KB (11) or by OS (10) available in a database.

Which roaming subscriber numbers in OS (10) of KB (11) to generate test calls He needs to know that he is actively roaming. In one method, KB (11) records roaming subscriber numbers. It regularly collects from VLR systems of OS (10) via the command line interface.

In another method, KB (11) records all MAP PRN messages from international networks. Thus, KB (11) reads the PRN for a recent call request. can collect roaming subscriber numbers from messages.

Before initiating a test call to a roaming subscriber number, the subscriber number of KB (11) it should check if the number is still actively roaming in OS(10).

In addition to checking the existence of the roaming subscriber number, KB (11), roaming a CFU (Call Fonivarding Unconditional) or incoming Checks whether the call blocking features are available. Before test calls, this If checks are not made, test calls will be sent from the roaming subscriber's own network to the OS. It may not be taken in the reverse direction to (10).

Similarly, KB (11) enters a local subscriber number before initiating a test call, if that If the local subscriber number is not roaming outside of OS (10), it can be selected. This measure is international Depending on optimum call routing in roaming YS (22) of test calls visited As a result, it prevents connecting to these selected local subscriber numbers in an YS (22). KB (11), it a MAP SRl-SM operation for this local subscriber number to obtain the current VLR information. can perform.

Determining GYKKl's of terminated calls In one aspect of this invention, when resource calls reach OS (10), OS (10) It triggers terminating calls of AANs to KB (11) in signaling. Resource calls TB They can be triggered from (21) or generated by KB (11). Resource calls to OS (10) correct either normal termination or normal interconnection as Inbound Scam ends via paths. This is an error made in the subscription profile of the terminated calls AAN. they are triggered from OS (10) to KB (11) due to change. This change is the end of the AAN. KB (11) before the resource call arrives, so that the triggers of the calls can be received. performed by. In Scam Terminated In Network, resource calls are from DB(30)'s may be taken as their national call. Due to this change in AAN's subscription profile, these calls are from OS (10) to KB (11) as triggers of AAN's terminating calls. they are triggered. Born on the Network are received as international calls. Since their AANs are international foreign numbers Therefore, a change in the profile of the subscription number of a foreign subscriber number KB (11) can't. Therefore, as a solution, OS (10) will send all its international calls to KB (11), neither is preconfigured to trigger. The birth made towards the AAN of this KB (11) makes it possible to associate international calls. These associated triggers The international calls that are made about the AANs are the ending calls. Test these AANs, either produced with roaming subscriber numbers for their calls or received from their TB (21) are the international foreign numbers that are related to their triggers.

After determining the terminating calls of the AANs, KB (11) has It identifies one or more of the call's GYKK and matches them with the AAN. Say resource If the calls are test calls, KB (11) terminated calls are detected as random subscriber calls. will not allow them to connect to AANs unless they are On the other hand, thanks to the source If the calls are triggered from their TB(21), then their terminated calls to connect to the KB(11) AANs. continues.

In another aspect of this present invention, KB (11) is used to determine the terminating call of the AAN. It uses the associated network RDKs of OS (10). Similarly, the KB (11) each determined determines one or more GYKK values for the terminated call and matches them with the AAN.

Since resource calls triggered from TB(21)s normally connect to AANs Therefore, KB (11) does not require any intervention to these terminated calls. can control the calls over the related network RECs. However, testing resource calls In case of calls, KB (11) should prevent AANs from ringing. (11), a CFU (Call) in the subscription profile of the AAN before the resource call reaches OS (10) Forwarding Unconditional) makes the change. This change changes the AAN's terminating calls to KB. (11) leads to. Thus, KB (11) corresponds to the AANs of the detected random calls. while allowing them to connect, it does not allow other terminating calls.

GYKK contains a Type Code, an Operator Code and an Operator Information. The value of the Type Code, if International if the terminating call was received via an international interconnection route, if this if the terminated call was received via a national interconnection route, if this terminated call Internally Born if a call was born in OS (10) or Internally as an absence value Gets the terminated value. Internally Terminated, other types of this terminated call in OS (10) means it is received via internal routes. Each interconnection partner of OS (10) and OS Each national operator in (10)'s country is assigned a specific code value in KB (11). GYKK this Operator Code, OS (10) for the interconnection partner from which this terminating call was received. is the custom code value. This Operator Information is the subscriber of the ANB of this terminated call. is the Operator Code for the operator. Any operator of the subscription or OS (10) interglanti partner or any national operator in OS (10)'s country. in a country national operator, if OS (10) has an interconnection with that national operator, OS (10) called interconnection partner. OS (10) interconnects with all national operators in the country may not have. National operators in the country using the country's national subscriber numbers are operators. By performing a NT query for ANB, the operator with the KB (11) subscription Identification of GYKKs via triggers of terminated calls In one aspect of this invention, AAN's GYKKs are determined by triggers. KB (11) primarily consists of one or more terminals of the AAN. determines the call. After that, KB (11) will send the determined GYKKs with the AAN of the resource call. it matches. Meanwhile, regardless of the trigger method or the associated network RFCs method As a result, the source call is normally expected to be received as a single terminating call. With this However, there may be exceptions for the AAN that cause multiple terminating calls to be received. This This is the reason why more than one terminated call can be identified. Accordingly, the intergland In order for fraud to be detected, at least one terminated call related to the originating call must be must be determined, otherwise this resource cannot be evaluated in terms of call fraud. For example, during the control of his AAN, one of the scammers tried to detect the operators. can implement alternative routing to break their algorithms. In alternative routing, The scammer first routes the international call through a legitimate interconnection path. from AAN After ringing or even getting a response, interconnecting while holding the nascent foot of the real call they make a second call with one of the scam types. In this example scenario, multiple be able to detect the terminated call, in any case during the control of the actual call It makes it possible to detect Network Terminated Fraud.

Triggers carry a Path Revealed at their end about the path the call entered OS (10). This Inbound Route Information A special code assigned for each different type of inbound route in OS (10) is the value. This inbound path can be an interconnection path or an internal path of OS (10). OS (10), of In trigger configurations, this Arrived Route Information of terminated calls is preconfigured. and they are added as a parameter to these triggers. Path Information, GYKK's Type Sets the Code and Operator Code values. KB (11) is a preconfigured mapping It determines the Type Code and Operator Code values from this Arrived Route Information.

Current Path Information is added to these triggers in the trigger configurations of OS (10). NW The mapping data of (11) and the configuration in the trigger settings in OS (10) are similar. For example, a terminating call is related to an interconnection partner named 'Carrier X'. in AD (12) of a mobile OS (10) if it has entered OS (10) via a national interconnection route. trigger setting is the custom code value assigned to this interconnection path as Information of the Traveled Path. which assigns '10) as the value. Upon receipt of this trigger for AAN from this AD (12), KB (11) uses a preconfigured mapping and this is Type Code, since the terminated call is received over a national type interconnection road value Indicates the national value. And assigned as an example for this 'Carrier X', a national operator The custom code value '3,' reports the Operator Code. ANBl for the call that has been triggered carry. KB (11) provides the Operator Information on the GYKK by performing a NT query for the ANB. determines. For example, if the subscription of the ANB belongs to this “Carrier X” which is this interconnection partner, In this case, GYKK's Operator Information will take the value '3'. However, thanks to this ANB If the call belongs to another national operator in the country other than the interconnection partner, this In this case, this Operator Information will take the value of the other national network's Operator Code.

KB (11) checks your AAN throughout the resource call. Some calls may take longer after being answered. Taking control of the KB (11) AAN from the beginning of the resource call, can terminate at the end of the pre-configured maximum control time. call source control has a preconfigured maximum control time, the AAN's The check can also be completed by KB (11) earlier than this maximum check time. NW (11), if this terminated call is a normal termination or as an interconnection scam if detected and thanks to KB (11) alternative routing check for this terminated call If he doesn't need to do this, he can complete this check sooner. This control is before the expiry of the control period, the resource call is due for any reason. It may also end because of its ending. Triggers related to the termination of control or It is applied regardless of whether the relevant network is determined by means of CFCs.

During the control of the AAN, KB (11) OS, in order to determine the terminating calls of the AAN It associates triggers received from (10) to AANs in real time. Your terminated call as soon as the trigger for a relation is determined, KB (11) will cause one or more It determines the GYKK in real time. During the control of the AAN, each identified terminating For the call, KB (11) interconnects on one or more GYKK that it has determined. applies the fraud detection method in real time. KB (11) next possible It evaluates each terminated call without waiting for the trigger, causing a delay. For example, KB (11) has determined a GYKK reporting a Type Code of Internal Born. and if AAN is a national subscriber number, then KB (11) will send the terminated call in Network It detects as Terminated Fraud and completes the AAN check. By the way, KB (11) It can also finish its operation before AAN's control. For example, if the resource call KB(11) if it is a generated test call, then KB (11) is the result of the generated test call of the terminated call. the situation that there may be a possible random subscriber call instead of a terminating call. against, it first terminates the test call and then sends the terminated call to the AAN. continues. For example, a GYKK declaring a Type Code of KB (11) National Value If so, then whether the terminated call is detected as Inbound Fraud. Regardless of whether it is detected, KB (11) is the next possible alternative for scammers Keep checking the AAN in order to detect the terminated calls related to the referrals. it can. Such real-time control of GYKKs, triggers of GYKKs or the related network is applied regardless of whether it is obtained from the MFCs.

When KB (11) receives a resource call for AAN triggered from TB (21) or a test just before generating its call, via the subscription interface of KB (11) OS (10) Applies a change to the AAN's subscription profile. This change only applies to local subscriber numbers. it applies that these local subscriber numbers belong to OS (10)'s actual subscribers. are numbers. This change changes the AAN's terminating calls to KB (11) as signaling. makes it possible to trigger. This change in the profile of the AAN is the control of the AAN. returned upon completion.

In one aspect of the method, KB(11) is triggered by SIP as an Application Service. in the subscriber profile this change includes an Application Service definition. Route Information SIP INVITE Operator Identifier carried in the received-realm parameter in the Via header field of the message are the values. Alternatively, in the Via header area of the SLP INVITE message. FQDN (Fully Qualified Domain Name)* or IP (Internet Protocol) addresses carried. of SIP Because it adds the via header fields at each SIP unit along the call path, or because this SIP Since it can add Operator Identifiers depending on the configurations of its units Therefore, KB (11) can obtain more than one Path Information from these parameters. Indeed, KB (11), the Type of GYKK is one of the parameter values of the Travel Route Information in the INVITE message. a preconfigured mapping to obtain the values for the code and the Operator Code. uses. For example, a specific Operator Identifier value or a specific FQDN value Corresponds to the Traveled Path Information, which in the pairing configuration the specific Type Code and It is mapped to Operator Code values. Thus, the mismatched parameters are SIP in OS (10) Since they do not belong to their units, they are discarded by KB (11). ANB of the terminated call It is carried in the Telephony URI parameter in the From header in the SIP INVITE message and called party number Telephony URI in To header in SIP INVITE message carried in the parameter. A change in AAN's subscriber profile causes a DH (Default Handling) parameter contains the DH value which is mandatory for resource calls generated as test calls Mandatory for resource calls triggered from TB (21) takes a value that means not.

If AAN's source call is a test call generated by KB (11), KB (11) terminates AAN of these terminated calls by controlling the calls over their triggers. won't allow it to bind. Checking the terminated call is mandatory in OS (10) In this case, continue this incoming call unless OS (10) receives a response from KB (11) to a trigger. can't. The purpose of this is to ensure that any possible operational a precaution against malfunction or any communication problem on OS (10) side with KB (11) As a result, OS (10) will not connect to this inbound AAN.

If AAN's resource call was triggered from TB (21), then KB (11) Allows it to connect to the AAN. In this case, checking of terminated calls is mandatory in OS (10). is not. Depending on the DH parameter, this will occur for a predefined timeout in OS (10). If no response is received from KB (11) to trigger, OS (10) continues this incoming call. it can. The purpose of this is to ensure that any possible operational a precaution against malfunction or any communication problem on OS (10) side with KB (11) As a result, OS (10) will always connect these terminating calls to its AAN.

In another aspect of this present invention, an SCF with the KB (11) INAP or CAMEL protocol is used. as triggered. Change in subscriber profile will result in an existing TDP for calls ending in INAP. It contains the definition of (Trigger Detection Point). The change in the subscriber profile is in the CAMEL protocol. and a T-CSI (Terminating Camel Service Information) defined in HLR (35) of this AAN contains the definition. Path Information IDP message in INAP and CAMEL protocols It is carried in the key parameter. Unlike SIP, LDP carries a single Service Key value, which is value only points to a Travel Path Information on trigger. Accordingly, This Way Its information only refers to the Type Code and Operator Code of a GYKK. INAP and CAMEL ANB of this incoming call in the Calling Party Number parameter of the IDP message in the protocols is carried and in the Called Party Number parameter of the IDP message, this caller of this incoming call number is moved. In lNAP and CAMEL protocols, a change in this subscriber profile is a DCH Contains the (Default Call Handling) parameter, whose DCH value is the source generated as test calls. While getting a value that means mandatory for their calls, the source triggered from TB (21)”s Takes a value that means not mandatory for calls.

Checking of terminated calls for resource calls with test calls generated by KB (11) mandatory. The reason for this is that the real subscriber numbers dialed by KB (11) are disturbed. it has to be avoided. OS (10) responds to trigger the terminated call from KB (11) cannot continue unless received, which stops the test call from connecting to the AAN. On the other side, Terminated for resource calls triggered from TB (21) like actual calls of YS (22) Control of calls is not mandatory. In this case, real calls are normally assigned to AANs. they need to be tied. Therefore, against any possible operational failure in KB (11) or KB (11) as a precaution against any communication problems, KB (11) thanks to KB If there is no trigger response from (11), it can continue the terminated call. this behavior To set it as mandatory or not mandatory, the DCH value is set in the profile of the AAN.

DCH is like DH parameter set in Application Service profile of AAN in SIP.

Figure 7 triggers terminated calls in OS (10) for a mobile base network. shows. When the terminated call is received by AD (12), the HLR (35) of AD (12) AAN performs a MAP SRL operation with and returns a T-CSI parameter, which is T-CSI parameter AD (12) uses an IDP message of the CAMEL protocol to send the terminated call. Causes it to trigger KB (11). The reason for this is specified by the T-CSI parameter. SCF is configured in OS (10) as the SCCP GT address of KB (11). T-CSI parameter before generating the test call or after receiving a trigger from a TB (21) It is set in the profile of the AAN. KB (11) will take the trigger and set the Called Party Number parameter of the IDP. when associates it to AAN using determines. Since the terminated call entered OS (10) via an AD (12), GYKK value of the terminated call is the value of the inbound interconnection route to a national or international road. shall include a Type Code indicating an International or National value, depending on whether and NW (11) will match this GYKK to this AAN under its control.

If the origin call for the AAN is a generated test call, then KB (11) will replace the terminated call. can decide to answer. To respond, KB (11) sends a trigger response to AD (12) which answer is CAMEL Conenct or ETC (Establish) with a test number to connect Temporary Connection) message. Upon receipt of the message, AD (12) sends the terminated call to this forwards it to the test number. OS (10) will forward this test number to KB (11) and terminate is configured. Thus, KB (11) can answer the terminated call. If the resource call is a If triggered from TB (21), for example a real call, the terminated call will trigger a trigger to AD (12) followed by a CAMEL Continue message in response. This is the continuation of the real call. After execution, AD (12) performs a second MAP SRI with HLR (35), which is a Returns the MSRN value. AD (12) terminating calls MSC determined by this MSRN (Mobile Switching Centre) in other words to SD (13), where this terminated call It connects to the User Device (42) of the AAN.

As shown in Figure 7, Fraud Terminated in the Network or Born in the Network In the case of fraud, the DB (30) is a Radio Base Station using a "SIM Box" number. T-CSI parameter set in the profile of the AAN to perform the operation and in response when returned, this terminated call is triggered by a CAMEL IDP to KB (11). KB (11) this receives the trigger and sends it to the AAN using the Called Party Number parameter of the IDP message. when associated, then KB (11) determines the GYKK value of this trigger. GYKK, SD A Type Code of Internally Born according to the Service Key value set in (13) will indicate. KB (11) matches this GYKK with AAN and the ANB of this trigger is in Network. Sets it as the Terminated Network Fraud Number. For example, if the resource call is a if it is a real call, then KB (11) continues the call and the terminated call is detected by SD (13). It connects to the User Device (42)* of the AAN.

In mobile networks, internationally terminated calls can be triggered to the AAN at AD (12).

This is because, in response to the MAP SR1 message, the HLR (35) of the AAN is the termination of the AAN. It sends triggering parameters to AD (12) so that its services can be triggered. However, In non-mobile networks, calls normally enter via AD (12) and are sent to AAN. The final SD (13) for Figure 8 shows the triggers of terminated calls in OS (10) for a fixed network. this fixed network is a traditional PSTN (Public Switched Telephone Network) or SIP It can be the NGN network that supports it. When the terminated call is received by AD (12), AD (12) forwards the call to SD (13) of the AAN. In case of INAP, KB(11) to receive triggers due to the existing TDP setting for terminated calls in the subscription profile of the AAN it has set, SD (13) triggers the terminated call to KB (11) using an INAP IDP message. IDP trigger message to your AAN using the Called Party Number parameter, KB (11) determines the GYKK value of the trigger. GYKK value determined for this trigger normally contains a Type Code with an Internal Terminated value. Trigger of SD (13) a configuration of OS (10) coming from AD (12) or another intermediate node in OS (10). can add a Service Key that specifies its internal path. This is because the terminating KB (11) It has no information that the call enters OS (10) via an interconnection path of AD (12). is not.

KB (11) can answer the terminated call if the source call is a generated test call or if the source call is a real call, it can resume the session. Continued real calls They connect to the User Device (42) of the AAN. Sayet DB (30) call a Subscription to DB (30) If it terminates using the Access Interface (20), SD (13) similarly for the AAN KB (11) triggers. But this time, the trigger's determined GYKK has a value of Internally Born. Includes Type Code.

Figure 9 shows the triggers of terminated calls in OS (10) for an IMS network. these IMS networks may serve different fixed or mobile access networks. Terminated call When received by SBC as AD (12), AD (12) forwards the call to I-CSCF (45). I-CSCF (45) From HSS (43) using Diameter LIR (Location Info Request) operation, S-CSCF of AAN (Serving-Call Session Control Function) information. I-CSCF (45) this terminating SlP forwards its call as SD (13) to S-CSCF. Sayet S-CSCF has an active resource for AAN if not, SD (13), using Diameter SAR (Server Assignment Request) process, from HSS (43) requests the subscription profile. Application Server Subscription Information from profile data Upon receipt of its data, SD (13), Application of KB (11) along with other services of AAN Triggers the service. Using the Telephony URI parameter in the To header of the INVITE message after associating the trigger to the AAN, KB (11) will have one or more It determines the GYKK and matches them with the AAN.

If the origin call of the AAN is a generated test call, then KB (11) will replace a terminated call. can decide to answer. To answer, KB (11) SIP to end the session and log out. can answer. If the resource call was triggered from TB (21), for example, if it was a real call, The INVITE message of the terminated SIP call is resumed back to SD (13). SD (13) this INVITE transmits the message to the User Device (42) of the AAN. SIP call ending, ringing or In order to track end-to-end events such as the response, KB (11) INVITE itself You can add it to the Record-route header field and the Via header field of the message. By the way, the source is a call if it is a generated test call, in the filter criteria definitions for the Application Service for the AAN an answer from SD (13), KB (11), since the previous Default Handling setting is mandatory cannot continue the terminated call without receiving it. So, thanks to KB (11) SIP call if it decides to terminate it, it will send back a final reply to SD (13) for the INVITE message and SD (13) It does not continue to trigger other services of the AAN and terminates the session setup.

In the case of Fraud Terminated in the Network or Fraud Born in the Network, DB (30) Ends the call to P-CSCF (44) or A-SBC (Access-Session Border Controller) of (10).

P-CSCF (44) sends this call to I-CSCF (45) to determine the S-CSCF of the called subscriber. and forwards the I-CSCF (45) INVITE message to the S-CSCF. Similarly, the SD (13) INVITE message It triggers KB (11)* by forwarding it to KB (11). Telephony URI in To header of INVITE message After associating the trigger to the AAN using the parameter KB (11), identifies one or more GYKK and matches them with AAN.

As shown in Figures 8 and 9, an SD (13) terminates call on non-mobile networks. when triggered, OS (10) will provide Path Information to KB (11)”. must be configured. Otherwise, SD (13) triggers are only Internally Born will specify the Type Code with the value and the Operator with OS (10)'s own Operator Code It will indicate the code. There are two methods to solve this problem. OS (10) of terminated calls In order to obtain the Path Revealed Information regarding the first entry point, the first method is the Path Traveled. It is the transfer of the information up to SD (13) in the carrier protocol. The second method is in AD (12) is that all incoming calls are triggered to KB (11) so that KB (11) terminated calls are sent to AAN. associates it.

In the first method, according to Figure 8 and Figure 9, regarding the terminated calls coming from the interconnection paths, Route Taken Information or Path Taken for calls originating in OS (10), call carrier It is moved to SD (13) in the parameter fields of the protocol. SD (13) indicates that these parameter fields uses its values as the Arrived Path Information of the terminating call and adds them to the triggers. can add a special prefix to the called party number. Each different interconnection path in OS (10) A special prefix is assigned in this way. When the call is received in SD (13), according to the received prefix, the number of SD (13) trigger settings will assign the Service Key value of the IDP message to the value of this prefix. is configured so that this Service Key value is used as Path Information in KB (11).

For SIP, Operator Identifier, FDQN or IP information in Via header is sent to KB (11) along the way. until moved. When SD (13) triggers the terminated call with SIP INVITE message to KB (11), These parameters added at nodes such as SBC, P-CSCF (44) or A-SBC are in KB (11) will be used. In other words, SD (13)'s in any previous AD (12) or OS (10) will pass the parameters added by the source node directly to KB (11). Like this, Matching the values of these received parameters used as the Path Information It determines the Type Code and Operator Code values of the KB (11) GYKKs.

In the second method, as shown in Figure 8 and Figure 9, all incoming calls, OS (10)'s AD to enable KB (11) to associate incoming calls to AAN At (12) they are triggered to KB (11). Different from triggering terminated calls belonging to AAN As a consequence, this trigger is the pre-configured trigger setting in AD (12) of OS (10) that this setting triggers incoming calls arriving via interconnection paths. In other words, the source call Accordingly, there will be no change in the subscription profile of the AAN here.

Although this method triggers many calls not related to KB (11)*, this it also helps KB (11) get an additional trigger for the same terminated call. This addition triggering is taken from AD (12) where the terminated call enters OS (10) and normal triggering is from SD (13) where AAN terminated services are triggered in non-mobile `networks is triggered. In this case, KB (11) sets a GYKK value for additional triggering from AD (12) and determines a GYKK value for triggering from SD (13). KB (11) interconnect them pairs it with the AAN so that fraud assessment can be performed. It is preconfigured to add a Service Key. Because of the flexibility of SIP alternative methods can be used. In the first method for SIP, the forwarding of the SBC or AD (12) In the SIP unit configurations for the interconnection partners, each An Operator identifier is defined for a national and international interconnection path. Operator Considering the possible interference of scammers, a security in SBC and KB (11) key is defined. Accordingly, SBC uses the received-realm field in the Via header of the INVITE message. Adds this Operator Identifier inside the parameter. Via KB (11) one of the titles If it receives a SIP INVITE with the received-realm parameter, and it does not return any Arrived Path Information specifies a predefined value for the Operator Identifier, then this Operator Identifier value It is used as the Current Path Information for the trigger. Additionally, without using this parameter as a security precaution first, KB (11), JSON (JavaScript Object Notation) JWS (Web Signature) data has the same parameters as the received INVITE message.

This ensures that the Operator Identifier value is received from an SBC of OS (10). for SIP in the second method, the FQDN or IP associated with the interconnection paths of the KB (11) interconnection partners addresses that this information is included in the Via header when entering the SIP INVITE message OS (10) are added automatically. Sayet KB (11) does not have any prior information regarding any Route Information. If it detects a preconfigured FQDN or IP address that specifies a defined value, In this case, this Path Information is determined. They notify Application Services whether they are available or not. However, IMS and non-IMS but SIP SIP units in OS (10) as a general solution to networks that support Operator It can use IP addresses in the Via header to detect calls.

Born On The Network In scam, scammers move towards international foreign numbers OS They make international calls from (10). The AANs of these calls are received from their TB (21) triggers can have AAN*s, which are called international foreign numbers. they can be taken. Or, AANs are the roaming calls that KB(11) generates test calls. They can be subscriber numbers. OS (10) in order to detect Online Fraud it is configured to trigger all spawn international calls to KB (11) so that KB (11) relates the triggers of these emerging international calls to the AANs of the source calls. This trigger setting is statically configured in OS (10) and is not based on AAN, depending on As a result, the resource call will not change the subscription profile of the AAN. Number sought if numbers have international number prefixes, OS (10) is triggered. In IMS networks, this setting is also available to all subscribers as a general Application Service. configurable, thanks to this feature, the Telephony URI in the To header of the INVITE message KB (11) is triggered for internationally dialed numbers according to parameter. Similarly, As with the triggers of AAN's terminating calls, KB (11) is primarily triggers, Called Party Number of IDP message or Telephony URI of INVITE message. Associates it to the AAN using the parameter. Next, KB (11) is the prefix of this dialed number. determines one or more GYKK values for trigger-based triggers and sets these GYKK values. matches AANs under its control.

Determination of GYKKs via network CFCs for the terminated calls In another aspect of the present invention, KB (11) is one or more GYKK of the terminated call. uses OS(10)'s RDKs to determine its values. GYKKs of terminated calls It is determined using the AAN's associated network RFCs. These related network RFCs are part of OS(10). are obtained from the process. This process is OS (10)'s charging system or signaling monitoring. fed from the system. Start timestamp of this resource call and AAN association are sent to this process as parameters. This process is a system containing the relevant network CRCs. returns the list. Each row in this list columns the parameters of the corresponding network LDK contains in.

If the terminated call of the resource call has reached OS (10), at least one related network is in this list. CFC will remain. However, for example, if the call is logged from an AD (12) and an SD If terminated at (13), more than one related network for a terminated call will be a CFC. This the reason is that AD (12) and SD (13) will generate the CFCs related to the same terminating call.

Similarly, KB (11) will set two GYKKs for this call, each GYKK this one generated The relevant network is for the CFC. The first of these is a Type Code of International or National value. will indicate. The second one will specify a Type code with Inner Terminated value.

In order to determine the GYKK value of each associated network CFC, each remaining relation in this list must be The Incoming Route Name and Calling Party Number parameters from the network CDK are separated. KB (11) this You can set the Type Code and Operator Code values of the GYKK from this Incoming Route Name parameter, in advance. determines using a configured mapping. This Way Inbound Name is exactly the Way Arrived It corresponds to his knowledge. This is because the Incoming Path Name singly has an interconnection path. It defines it and specifies the interconnection partner from which the call was received. KB (11) Calling Party of this Calling Party Number by performing an NT query for the determines the operator that has the subscription. The value of GYKK's Operator Information is available for this subscription. is assigned the value of the Operator Code of the owning operator. In this invention revealed According to the definition of GYKK, KB (11) is a specific one for each national operator of OS (10) country. Sets the Operator Code value.

If the resource call is a generated test call of KB (11), then calls terminated from OS (10) In order to obtain GYKKs from the related network RECs without using triggers, KB (11)'s test calls should be prevented from ringing their AAN. However, the TB of resource calls When triggered from (21), KB (11) causes the AANs of the terminated calls to ring. can use the associated network LDKs method without having to block it. This is because, Unlike test calls, these resource calls have to connect to their AAN. This Therefore, during the control of the AAN's test call, a CFU in the subscription profile of the AAN change is made. This is because the control of the AAN is due to the CDR, not the triggers. analysis so that in the other case KB (11) can hold the terminated calls. would not have been possible.

This CFU is used to control the AAN's terminating calls. If this CFU definition is AAN if it is a local subscriber number, this local subscriber number is an actual extension of OS (10). is an active subscriber number of the subscriber. During the control of the AAN, this CFU setting Forwards AAN's terminated calls to a test number. This test number is OS (10) It is forwarded by KB (11) to KB (11). This CFU setting of the AAN is complete after the check of the AAN is completed. then it is returned. Unlike the trigger method, a terminating call of the AAN is sent to KB (11). when routed, it need not be handled by signaling alone, but the call carrier must also be managed by KB (11).

Due to the latency in the operator's LDC infrastructure, KB (11) can detect interconnect scam. can be detected with a delay. For example, KB (11), detected terminating called real Since there is no trigger communication to lower the KB (11) timely, this terminating Reports calls to interconnection partners as Inbound Fraud. That's why this late reporting of terminated calls is not important. Similarly, Mains Terminated A real-time experience during the call that ends in Fraud and Online Fraud Since no action is required, the network of Detected Fraud Numbers AAN Even if they are detected after receipt of the LFCs, they can be blocked. As for test calls, In case of a delay in the CDR process, the KB (11) is a warning of possible random subscriber calls. In accordance with the method for its detection, the test call is normally made after a pre-defined time. terminates in real time. Thus, the delayed receipt of the related network CFCs, Except for the late detection of interconnection fraud, it will not affect the operation of KB (11).

Detection and prevention of interconnection fraud During the control of the AAN, as soon as a GYKK is matched with the AAN, the KB (11) will be displayed in real time. as an analysis of this GYKK. Figure 10 shows the AAN's each determined GYKK. It shows the flowchart of the method for the analysis. At the beginning of the flowchart, KB (11), check if the GYKK has a Type Code indicating the value “Internally Born”. it does. If the answer is “Yes”, a born call in OS (10) of the terminated call of this GYKK means that it is received as a Network Terminated Fraud or Born in a Network. Indicates fraud. In the next step, the AAN of the terminated call is an international if it is a foreign number, the ANB of the call terminated in KB (11) is defined as Fraud Born on the Network. detects. This international foreign number is the number in circulation for a generated test call. subscriber number or an international call related to a resource call triggered from a TB (21) It could be a foreign number. In this case, this terminating to international foreign numbers Calls are international calls born in OS (10). On the other hand, if AAN OS (10) is a if it is the local subscriber number, then KB (11) will send the terminated call of GYKK to the Network. Detects as Fraud for the Terminated Network. And this is the ANB of the terminated call It is detected as the Fraud Number for the Network Terminated in the Network. This local subscriber number is a national real subscriber number of OS (10). In this case, this local subscriber Terminated calls calling numbers are national calls originating in OS (10).

At the start of the flowchart, the GYKK has a Type Code indicating “Internally Born” if not, but if the Type Code of the GYKK states "International" or "National", then this means that this terminated call of GYKK is via the interconnection paths of OS (10) has been taken. If the Type Code of the GYKK states "International", this is a part of the terminated call. It means that it is taken over the international interconnection route. Some countries such as the European Union In countries, the interconnection fee for the terminated calls is determined according to the origin country of the calls. And this The origin of international calls is determined from the ANB of the terminated calls. For this reason, by the way, for the ANB of the terminated call of GYKK, the origin call is higher than the original ANB. If a low interconnection fee applies, KB (11) will send this terminated call to an Inbound ANB. Detects as Corruption Scam. In this scam scenario, scammers ANB of international calls from a country with a lower interconnection fee they manipulate or corrupt Sayet GYKK's call A lower interconnection fee for the ANB than the original ANB of the resource call if not, then KB (11) is an interconnection scam for this terminated call. decides not.

On the other hand, if the GYKK's Type Code states "National", this is the case of the GYKK's terminating means that the call is received over a national interconnection route. In the next step, KB (11) Compares the Operator Code and Operator Information values of GYKK. Operator of GYKK Code interconnection partner or operator from which the terminating call is received from the national interconnection path specifies the network. Operator Info as a subscriber to ANB in the terminated call of GYKK operator network in the country that currently owns it, or in other words the Operator Code reports. If the Operator Code and Operator Information values of the GYKK are equal, the KB (11) terminated identifies the call as Out of Network Fraud Terminating In Network and this terminated The ANB of the call is detected as the Out of Network Fraud Number Terminated in the Network. For example, scammers use ANBs to transfer their ANBs to subscriber numbers of other national networks in the country. they can appoint. Sayet KB (11) does not compare GYKK's Operator Code and Operator Information if it were, this would cause errors in detecting the Scam Numbers of manipulated ANBs. would open.

Besides, if the Operator Code and Operator Information of GYKK are different, the KB (11) detects the terminated call as Inbound National Road Scam. This is fraud In type KB (11), the scammer's resource call is sent to a national interconnection route instead of an international interconnection route. detects that it is attempting to terminate via the interconnection path. This scam The reason is that in many countries around the world operators make international calls according to national calls. they charge a higher termination fee to termination. That's why scammers national instead of paying higher termination fees over international interconnections. They prefer to terminate in ways. As in the previous example, the rogue ANBini hides it and manipulates the ANB to a national number belonging to other operators, KB (11) detects the terminated call as a result as an Inbound National Route Scam.

In addition, OS (10)'s interconnection partner may have a License to carry transit traffic in the country that means that they receive these calls from other networks and carry them to another network as a carrier. income. The terminated calls of these interconnection partners depend on which networks they are carrying traffic from. It includes different ANBs. However, an interconnection partner has a license for it. if not, this also means detection of unlicensed traffic relocation. For example, a national mobile operator, if we put aside specific call forwarding scenarios, It normally terminates calls to OS (10) with their subscriber numbers, ANBIs.

Therefore, the terminated call is detected as an Inbound National Route Scam. and a license to carry traffic in transit in the interconnection partner country that terminates the call. if not, KB (11) generates an informational alarm to the operator. In this case, the operator can notify the interconnection partner to check if there is a problem and accordingly situation with the regulatory agency in their country against a possible violation of the regulation on the subject they can report Fraud Numbers Born In The Network, On The Network Fraud Terminated In The Network Numbers and Off-Network Fraud Numbers Terminating in the Network Detected in KB (11) They are kept as Fraud Numbers. Detected interconnection fraud, Calls from Detected Fraud Numbers are prevented by blocking them. Control of KB (11) The possibility of receiving a random subscriber call that coincides with the AAN during is a possibility. Scientifically, a normal subscriber has different AANs of the ANB and these AANs. It is a fairly negligible probability that they will make calls to coincide with their checks. From this therefore KB (11) will recursively display the Detected Fraud Numbers a predefined number of times. Blocks it after it is detected as a Detected Fraud Number. This is practically normal Eliminates the possibility of blocking subscriber numbers. How much risk does an operator take? Depending on how you avoid it, the operator can set Detected Fraud Numbers to a predefined a large number of times can wait to be detected again. OS (10) predefined the risk level can choose by adjusting the number. For example, operator detects the same ANB for the second time To prevent it after it is detected as a Fraud Number, this pre-emption can set the defined number to two.

According to the method, KB (11) adds this Detected Fraud Number to a list. in this list After each Detected Fraud Number is listed, a predefined period of time It is automatically deleted from this list by KB (11) as of its expiration date. This is the default time if each Detected Fraud Number is detected again, it starts. While this Detected Fraud Number is active on this list, Detected as a configurable number of consecutive Detected Fraud Numbers has been detected, then there is a block on this list for this Detected Fraud Number. flag is activated. Preventive flag for a Detected Fraud Number in the list When detected, KB (11) will automatically prevent for Detected Fraud Number they get to do it.

If the subscription of the Detected Fraud Number belongs to OS (10), then the KB (11), the block flag in this list is active via the subscription interface of OS (10). Outbound and inbound calls for Detected Fraud Numbers Activates the blocking feature. Operator, In Network Terminating in Detected Network It can block Scam Numbers to interconnect partners who have subscriptions.

In addition, the blocking speed is very important for operators in order not to lose revenue with each passing hour. Because it is important, the operator does not receive any calls from these interconnection partners. It can block incoming calls with Terminated Out of Network Fraud Numbers. Detection In order to prevent Out-of-Network Fraud Numbers Terminated in the Network, incoming directional calls from national interconnection directions are triggered in OS (10) to KB (11), so the ANB of triggering for one of these incoming calls, blocking in this list If the flag is active Detected Fraud Number, this In this case, KB (11) blocks the incoming call belonging to this trigger.

At this point, this predefined time can be important for keeping a number on the list. For example, a Detected Fraud Number is detected as a fraud number. by a regular subscriber of a national operator within a period of time after the number Once purchased, KB (11) will continue to block calls from the same numbers.

However, the Detected Fraud Number has expired after the predefined period. If deleted from the list after expiration, KB (11) does not block incoming calls. Because, There will be no problem in terms of legitimate use of ANBs by normal subscribers. This By the way, this predefined period is the old subscription of national operators in the country. it should be held for less than the time they sell their ANB to a new subscriber after terminating it.

Interconnection scam Ending calls detected as Inbound Scam It can be avoided by automatically blocking by KB (11). NW (11) also Inbound Direction Terminated calls detected as scam, inbound traffic on Inbound Direction Reports to interconnection partners to clear them of fraud. Generated test calls Calls terminated on Inbound ANB Scam Scam or National Route Inbound When detected as fraudulent, these test calls are for interconnection partners. It has the quality of evidence regarding the violation of the interconnection. In practice, the interconnection partner prefixes these records. can use it to solve the problem with carriers. However, in most cases it is too late to reach a conclusion. causes waste of time and energy and a permanent solution may not be reached.

Although test calls provide valuable data, TB as actual calls of YS (22) Resource calls triggered by (21) are a permanent and deterrent against Inbound Fraud. provides a solution. This is because if AAN's terminating calls are triggered to KB (11), KB (11) Real calls detected as Inbound Scam during AAN's control can block in real time. This ability prevents these types of scams, KB of real calls. It completely solves for YS (22)'s that can be triggered to (11). Thus, in a short time, carriers or even interconnection partners, traffic due to unsuccessful calls to previous carriers he has to stop carrying fraudulent traffic from these YS (22) because he will get it back they will stay.

If the terminating call was triggered from OS (10), KB (11) will deactivate the terminating call from that terminated call. can terminate the call via the trigger communication. Ending call in Inbound Direction Prior to termination due to fraud detection, random subscriber calls it must be separated by KB (11) so that it is not blocked. This is because Inbound Direction In fraud, as in the fraud that is born in the network and terminated in the network, it is repeated is that there is no ANB that can be detected in this way. Accordingly, there is no information about this source call. if the following message reports a ring or answer for this resource call, and only if For this terminated call of the AAN, a response is received within a predefined number of seconds. If no ring or answer is received, this will indicate KB(11)'s AAN's terminated call. It means that it detects it as a random subscriber call. Thus, KB (11) detected it does not block random subscriber call.

As an alternative to blocking real calls, the operator interconnects at the end of the payment period. If they have agreed in this way in their contracts with their partners, they will be able to make interconnection payments. can be offset. For example. This method allows the network for the terminated calls of the source calls It can be used if determined through the RDKs. To achieve this, the operator, if necessary share a report of the KB (11) with its interconnection partners with the details of the supporting CFC, and interconnection payments can be adjusted accordingly. Automatically without blocking similar to the determination of random subscriber calls first, the KB (11) random subscriber It can be configured to report to interconnection partners by excluding calls. This the situation is due to the fact that scammers manipulate the timings of call events, some It may cause the terminated calls to be detected and filtered as random subscriber calls.

Therefore, alternatively, KB (11) detects all terminating calls of an interconnection partner. can report random subscriber calls without filtering, but only if terminated calls The number is more than a predefined ratio of the total incoming calls from the interconnection partner. If it is high, it makes this report. This will mean that random subscriber calls The error rate caused by a sufficiently high amount of fraudulent traffic from the interconnection partner Therefore, it will be reduced to negligible level.

In Inbound ANB Scam Scam, KB to terminated calls without ANB Action must be taken in (11). Termination of Inbound ANB Spoofing Scam In countries where the interconnection fee is applied according to the ANBs received for the terminated calls operators in these countries, terminated calls without ANB they should either block it or charge it one standard higher. your operator According to the principle of KB (11), terminating calls without ANB, real calls To prevent being received as terminating calls with a code value of International configurable.

Resolution of 'random' subscriber calls and wrong answer/anh in test calls In the prior art, during the control of test calls generated towards AANs, random normal installation of subscriber calls fails. Random subscriber calls throughout his control Normal subscriber calls to AAN. This is a problem of the prior art and is particularly In customer-oriented markets, test calls make the production method impractical. to the customer experience in these markets at least as much as the revenue lost from interconnection fraud. importance is given. In addition, as a terminating call for a test call of KB (11) In the case of the terminated call that it is assumed to have chosen to answer, this desired test There is a risk that a random subscriber call will be answered instead of the call. This is revealed The invention solves a very important part of these unsuccessful calls and incorrect answers. This Although there is still a remaining probability of this risk in the invention, this probability is comparable to the prior art. has been reduced to a fairly high level. In the first part of the solution, the call terminated Scam or the Network Terminated Scam If Dogan is detected as Fraud, then KB (11) will first send the test call. terminates. After a predefined period after this termination, connecting to KB (11) AAN Resumes any pending terminated call. Thanks to this ending call if it really belonged to a test call, then this test call is terminated would not have made AAN's phone ring. On the other hand, thanks to this ending if the call had been a random subscriber call, then it would have successfully connected to the AAN. it would be tied. This situation means that the terminated calls are called Fraud Terminated in Network or In the event that it is detected as Born in the network, random subscriber calls saves from failure. KB (11) uses this method to trigger AAN's terminating calls. or over the forwarded calls of the AAN's terminating calls.

However, the terminated call's Fraud Terminated in the Network or Born in the Network The problem is a little more complicated if it is not detected as a fraud. In this case, this terminated calls come from interconnection paths of interconnection partners and terminated calls GYKK's Operator Code and Operator Information regarding the call have different value. another one In other words, terminated calls either as normal termination or as Inbound Scam. detected. Therefore, in addition to the obligation to recover possible random subscriber calls As a precaution against the alternative routing problem of KB (11), these terminated calls Some must be answered. However, due to the cost to the operator, KB (11) It should also keep the amount of replies to a minimum.

In alternative routing, operators are increasing interconnection scams with an increasing effort. Some scammers are trying to prevent international calls primarily from operators. they terminate their legal international means. The dialed number rings or After the AAN answers, while the incoming call is held on one hand, the terminated call as Network Terminated Fraud via DB (30) or normal they are re-establishing it as an Inbound Scam call over interconnects. In the prior art, because these test calls were received from legitimate interconnections, and this Are the calls ending calls or random subscriber calls related to actually generated test calls? This is a problem of the prior art, as it cannot be determined whether they have calls. According to the prior art, an option is a call that terminates as a precaution against alternative routing. is to answer. Thus, the operator can detect the alternative routing attempt that will follow. can. However, this time there is a risk that a random subscriber call will be answered. Other as an option, test to ensure that any possible random subscriber call does not fail. termination of the call can be applied. Thus, the terminated call is about to be connected to the AAN. is continued. However, this also causes scammers to bypass this test call. Finally, it would be possible to continue this test call to connect to their AAN, which in fact is an option cannot even be seen as an AAN because these AANs are ringing or connected to their AAN. real subscribers will be disturbed. However, this invention is a In terms of alternative routing by scammers, like the real calls of YS (22) It has no effect on resource calls triggered by TB (21)'s. This is the reason majority of calls ring normally or are answered by their AAN is that. Therefore, regarding the reconnection of the call as an interconnection scam. on the next call attempt, KB (11) will detect the interconnection fraud.

In this present invention, an adaptive response method is applied to AAN's terminating calls. which method is alternative routing in case source calls are test calls it solves the problem. This method provides real-time control over the AAN's terminating calls. and requires intervention. KB (11) uses this method for AAN's terminating calls. routed calls over triggers or on AAN's terminating calls can be applied over. In this way, KB (11) is detected as random subscriber calls. It can connect or answer calls that terminate in case of case to its AAN.

In Fraud Terminated In The Network and Fraud Born In The Network, scammers OS Even if they terminated only one international call in (10), KB (11) will cancel the ANB of the calls. It detects it as a Detected Fraud Number. That's why answering these calls or there is no point in applying the adaptive answering method to these calls.

Receiving alternate routing attempt via normal international interconnection routes is expected. Scammers can use legitimate interconnection paths for terminated calls Due to the fact that this method is mainly called interconnected call interconnection scam. applied if not detected. In this case, the Type Code of the GYKK for this terminated call It is international. However, scammers do not allow calls answered by their AAN. Considering the cost, they can try alternative routing with lower interconnection cost.

Therefore, even though they have been detected as interconnection scams, Detected as ANB Rogue Scam or National Road Scam Inbound terminated calls are also included in this method.

According to the method, two main conditions controlled by KB (11) through the control of AAN has. As soon as one of the conditions is met during the control, KB (11) will use the method for this condition. implements. The first main condition is from calls terminated as of the start of the test call in KB (11) It is a check if any of them are received with the original ANB of the test call. Produced test Receiving a terminated call that has the same ANB as the call, this test proves that it belongs to the call. Therefore, during the control of the AAN, other terminated calls they are detected as random subscriber calls and connected to their AAN. This is another ending calls are received by KB (11) before the terminating call with original ANB arrives. There may be calls on hold. Or these other terminating calls will come during the check There may be terminated calls. KB (11) is the original version of the test call of these other terminated calls. Makes sure you don't have an ANB. This means that KB (11), random subscriber By answering the terminated call for the test call without risking their call, fraudsters can handle alternative routing.

KB (11) either terminates or answers the terminated call with its original ANB. Test Answering their calls incurs a cost to OS (10). By KB (11) of the test call In case of direct generation, the cost of the outgoing international call is less than the ending call. There is a cost because it is higher than the income to be received. Similarly, TÇUS (31) The cost of answering the test call generated through will be higher than your income. Therefore, in order to control the amount of response, the test A predefined response rate is configured for each YSO of their calls. According to this KB (11), the rate of test calls answered by this predefined rate of test call's YSO If it is lower than the answer rate, it answers the terminated call. KB (11), each YSO counting the number of each generated test call and the number of responses to those test calls Calculates the ratio for these answered calls. Although not normally expected, An additional terminating call received with the original ANB during the control of the AAN case, KB (11) applies the same method for each terminating call received in this way.

The second main condition is that for at least one predefined period from the start of this test call. whether any of the terminated calls were received with the original ANB for this test call. is control. During this Default time, KB (11) will call a terminated call with the original ANB. waits. After this default timeout period, if KB (11) If it detects that there are no terminated calls, then the KB (11) is the one received with a different ANB. decides to continue with any other terminated call. So, KB (11) is first for this is a terminating call that has been received with a different ANB within a predefined period of time. it checks to continue with this call. By the way, an already taken ending If there is no call, then KB (11) will be transferred to a different ANBl or the original during the control of the AAN. It waits for a terminated call that may have an ANB. Original of future terminated call In case of having ANB, KB (11) applies the previous method.

If the incoming terminated call was received with a different ANB, KB (11) Either terminates the terminated call or, according to the instantaneous value of the Adaptive Answer Flag, answers. This Adaptive Reply Flag is for each YSO and Operator Code pair by method. It is set by KB (11) to a binary value that can take True or False values. Operator Its code belongs to the GYKK for the terminated call received with a different ANB. Operator Code, specifies the interconnection partner from which the terminated call was received. In this way, the method is different YSO and It is applied on traffic groups on Operator Code pairs. In other words, if the scammer is implementing the alternate routing for origin traffic from a YSO, and if attempts are terminated through a specific interconnection partner, then the method KB(11) than applying for test calls coming from the same YSO but received from other interconnection partners will be protected.

If the value of this Adaptive Reply Flag is False for any pair, then KB (11) terminates the test call and waits for a predefined timeout period to expire. count if these terminated calls are not terminated by this default timeout period, in this case, these terminated calls are detected as random subscriber calls and KB (11) by connecting to this AAN. This is because the original test call of these terminated calls It is taken with a different ANB than the ANB. So KB (11) is a possible random subscriber He couldn't risk answering his call.

Otherwise, if these terminated calls are terminated by this timeout, then KB (11) increments the value of an End Counter for this pair by one. This Termination Counter Counts the termination events of the calls, which test calls in these terminations, YSO and Operator It is assumed that they are received from a different ANB than the code pair and these calls are random subscriber calls. are not detected. Adaptive Response Flag, this is a calculation based on the Termination Counter is set via. Thus, the amount of such terminations equals the terminating call of KB (11). He determines how he will decide whether to answer or not. Having said that, a alongside the scammer's alternate routing attempt, this termination attempt legitimate interconnection It may also be a normal call received via the route. Legitimate international interconnection routes Considering the fact that most calls received via will have the original ANB taking the counted terminations as a possible alternative from the YSO-Operator Code pair it will be more likely to point to a redirect attempt.

KB (11) sets the value of the Adaptive Answer Flag to one for each YSO and Operator Code pair. Sets by calculating the Termination Rate and a Response Rate. These counters and calculated values are kept independently of other YSO-Operator Code pairs. This kind through pairs, YSOs are grouped on the basis of interconnection partners so that KB (11) use the adaptive response behavior for the traffic that scammers receive specifically from a YSO on specific interconnection partners over which they attempt alternative routing can focus. This feature allows alternative routing from a specific YSO but scammers Incorrect response to test calls received via interconnection partners that it does not use for eliminates the risk.

KB (11) includes this Termination Counter, a Test Call Counter and, on the basis of each YSO-Operator pair maintains an Answer Counter. This Termination Counter has a Test Call Counter and a The values of the Answer Counter, so that this Termination Counter does not exist for a predefined period of time. has not been incremented or has been preconfigured since the last reset of this End Timer. If a certain amount of time has elapsed, they are then reset. This is to ensure that any If there are no such endings from the pair currently, then KB (11) does not answer won't. The Test Call Counter displays these test calls generated by KB (11) from each pair. counter. The Answer Counter displays these test calls answered by KB (11) from each pair. counter. Termination Rate and Response Rate, so this Test Call Counter is a default If it is greater than the number, it is calculated. Termination Rate, Test Call Counter of Termination Counter calculated by dividing. Answer Rate, Answer Counter to Test Call Counter calculated by dividing.

BP (11), as long as this Termination Rate is higher than a default threshold value, this Adaptive Keeps the value of the Answer Flag to True. This threshold value is preconfigured for YSO. has been made. Similarly, the Response Rate is a pre-configured default value for the YSO. As long as it is higher than the threshold value, KB (11) denotes the value of this Adaptive Reply Flag. Keeps it wrong. Response Rate Termination in determining the value of the Adaptive Response Flag It has priority over the ratio. This means that the condition for the Termination Counter provided that the Response Rate is calculated higher than the threshold value, BP (11) does not answer a terminated call related to the test call.

Accordingly, the value of the Adaptive Answer Flag is True for the pair associated with the terminated call. if it has For a random time between the minimum and maximum value, it answers. relating to a couple The value of the Termination Counter is a bi-directional link for the answered test call, with KB (11) If it detects the installation, it is incremented. Otherwise, a two-way call is received on the answered call KB (11). If the connection does not detect the establishment, the value of this Termination Counter is decremented by one. bidirectional connection From this detection of an incorrect answer to a possible random subscriber call as a result of therefore KB (11) to not encourage answering on calls ending after the same pair Decreases the value of the End Counter. Phone randomly selected for answered calls conversation recordings are played. KB (11) indicates the caller side of this record in the emerging leg of the test call. and KB (11) plays the called side of this recording on the calling side that terminates. These records over time they are updated with new records. These measures gave natural answers as if they were from real subscribers. taken to be.

By applying these methods, first of all, KB (11) will fail random subscriber calls. saves it from. Secondarily KB (11), incorrect response to possible random subscriber calls a countermeasure against scammers' alternative diversion by minimizing the risk of provides a solution.

System apps A KB for applying the methods of the present invention with regard to the functions of KB (11) The system is configured. This KB System uses the call information of resource calls and Configured to check the AAN of each resource call along this each resource call has been made. Configure the KB System to check the terminated calls of this AAN. has been made. This AAN is a real subscriber number. Throughout the control of this AAN, the KB System will determine at least one GYKK for each terminated call and these determined GYKKs with this AAN configured to match. KB System, these determined GYKKs of this AAN By analyzing ANB Scam Scam Inbound, National Route Inbound Fraud, In-network Fraud, In-Network Terminated in the Network Detect and prevent Fraud and Off-Network Fraud is configured. KB System also sends resource calls to real subscriber as AAN*Iari. It is configured to generate as test calls making calls to phone numbers.

The KB System directly generates test calls using signaling and carrier protocols. NW System test calls either directly to International Traffic Carriers (25) or OS (10) transmits via The KB (11) system has also been adapted to use TÇUS (31)'s. This TÇUS (31) sent source calls as test calls from all over the world, test probes, It is configured to generate using robots or search services. This TÇUS (31), Receives requests to start and end test calls from the KB System and sends ringing, answering and ending information to the KB System.

KB (11), KB (11) software modules on a redundant server hardware or in a cloud environment It can be configured as a running KB System. In this invention, the Local KB System KB System, also called KB System, with OS (10) locally in the operator's country. can communicate locally or within the cloud of OS (10). Only one to OS (10) In addition to serving as the local KB System, regulatory agencies of countries or operators in countries can establish a Local KB System serving the country's local national operators. can operate and position together. In this operating model, Local KB System, national OS (10) Communicates with them. Local KB System is triggered from TB(21) for resource calls.

Control of AANs and prevention of interconnection fraud, the country's local OS (10) or by the Local KB System serving the OS(10).

The TB (21) may alternatively be implemented as a TB System. This TB System resource calls It is configured to trigger call information as triggers to the KB System. A kind of triggers of TB (21), YS (22) in existing network systems in the system application. can be applied as a source. YS (22)'s networks to an MDB System or directly to the OS They configure their (10) to trigger their KB (11)*. These YS (22)'s are all over the world. and these source calls are the international calls of these YS (22).

In the second type of TB (21) application, TB (21)'s belong to countries other than OS (10)'s country. They can be implemented as systems. These resource calls are the OS of KB Systems belonging to these other countries. (10) are their international calls. All the OS (10) of these other countries are born they are configured to trigger their international calls to their own KB Systems. This As such, operators or service providers providing services for fraud prevention, In accordance with mutual agreements between operators and service providers, different They can share triggers between KB (11) from countries.

In the third type of application of TB (21), TB (21) is still different from the country of OS (10). They can be applied as KB Systems belonging to countries. However, these are from other countries' KB Systems. The resource calls provided also include all resource calls of the KB System. This resource The calls are not only the actual calls of the OS (10) of other countries, but also the KB of these other countries. It also includes test calls of their systems. Roaming of test calls of these other KB Systems Since it calls the Subscriber Numbers, the collection of the triggers of these calls, test call without carrying the responsibility of checking incoming calls to numbers This increases the diversity of the KB Systems of other countries that fulfill this responsibility.

In the fourth type of application of TB (21), TB (21) is from any third party service, can be triggered from the mains or from a TÇUS (31) which is TÇUS (31) or even fraud detection it may even be generating test calls for a purpose other than KB (11) in OS (10) these test calls It can use the call information for the detection of Online Fraud. For example, TB (21)'s any TÇUS (31) can be any TÇUS (31) from YS (22) around the world accurate test calls to real subscriber numbers belonging to different countries around the world MDB 24 can be implemented as an MDB System. MDB System TB around the world To provide a central communication between their (21) and OS (10), their KB Systems configured and receives triggers of resource calls from TB (21) and these resource calls Triggers OS(10)s to KB Systems. Similar to KB System MDB (24), MDB (24) software An MDB System running its modules on a redundant server hardware or in a cloud environment can be configured as One or more redundant MDB Systems geographically TB (21)'s may include triggers received from the world. The KB System minimizes the triggers of real calls. It is configured to receive from at least one MDB System. The MDB System is an independent MDB Besides working as a system, it can also work as a system with the KB System. This combined system works as both MDB System and KB System. For example, worldwide If there is only one KB System at the initial stage of the application, the MDB System is a unified system. can work with a KB System as where MDB System and KB Systems are the same they work as software modules working together on the hardware platform or virtual environment.

KB System is a system that serves operators located in a central location in a different country. It could be the Central KB System. Central KB System controls AANs and from different operators and offers interconnection fraud prevention service to OS(10) from different countries. local KB As with the System, the Central KB System is triggered from TB (21)”s for resource calls.

Central KB System can receive triggers from MDB System. Alternatively, for example, In the initial phase of the application, if there is only one Central KB System, the MDB System is the Central KB System. It can work on the same system with its system, which is Central MDB System and Central KB The system can work together as interactive software modules. Central KB System, central generates resource calls as test calls for its operators. Central KB System, International Signaling Carriers (23), VPN connections or secure internet (27) connection communicates with their OS(10) using

The functions of the KB System can be divided or distributed into central and local functions.

Considering the network security needs of the operators and the efficiency of the total system, The KB System consists of a Central KB System and one or more operators' Local KB System. It can also be configured to work together. Local KB System, locally an OS only to serve (10) or to serve one or more national OS (10) of the country locally can be configured to give In addition, the Central KB System in a central location, a It can be positioned to serve one or more Local KB Systems. local KB Use the system to check for AANs, detect and prevent interconnection fraud. is configured. The Central KB System, on the other hand, triggers the resource calls from their TB (21) or configured to receive from MDB System and route to Local KB Systems can be done. The Central KB System uses the resource calls as test calls instead of the Local KB Systems. It is configured to produce Central KB System will provide information of test calls to be generated. It gets it from the local KB System. Central BP System Playing test calls to Local BP System, It communicates call events such as answering or terminating. Test call information It includes AANs, ANBs and YSOs related to their calls.

Industry Applicability Interconnection fraud, telecommunication operators and, accordingly, states, It causes a significant amount of income and tax losses in an increasing trend around the world.

In addition, the uncontrollable technical infrastructure of scammers makes customers important service quality. is exposed to problems. As a result, operators are inclusive against scammers, seek consistent and deterrent solutions.

Claims (1)

REQUESTS Methods and systems for the Prevention of interconnection fraud in a telecommunications OS (10) (Operator Network), which use both real calls of real subscribers and calls made by test calls to real subscriber numbers. The AAN (Called Subscriber Number) of these real or test calls are controlled by a KB (11) (Control Unit). Inbound ANB (Caller Number Information) Spoofing Scam, Inbound National Route Scam, Network Born Scam and Network Terminated Scam, GYKK (Inbound Route Source Code)”s related to AAN's terminated calls are detected and prevented by analyzing them. In Inbound ANB Spoofing Scam, scammers terminate international calls with lower termination fee by manipulating caller number information or calling party numbers. In Inbound National Road Scam, scammers terminate international calls on national interconnection routes. In Network Scam, DB (30) (Scam Unit) makes international calls from OS (10) to international foreign numbers, which are exploiting OS (10)'s long distance calling tariffs. This DB (30) carries transit international calls as outgoing international calls from OS (10). In Network Terminated Scam, these DBs (30) make national calls to OS (10)'s subscribers to terminate international calls. In Network Born Fraud and Network Terminated Fraud, subscription numbers such as “SIM Box” exploited by DB (30) are blocked. KB (11) uses the call information of the source calls; - this is the AAN (Called Subscriber Number) of each source call this is controlled by the KB (11) during each source call, in which KB (11) records the terminating calls of this AAN checks, in which this AAN is a real subscriber number; - during the control of this AAN at least one GYKK (Original Path Source Code) is determined for each terminating call, in which KB (11) these designated GYKKs in this AAN and - Inbound ANB (Caller Number Information) Rogue Scam, Inbound National Route Scam, Inbound Scam, Network Terminated In-Network Fraud, and/or Out-of-Network Scam si Fraud is detected and prevented by AAN's analysis of these determined GYKKs. It is the method of claim 1, characterized in that the call information for these source calls is triggered as triggers from TB (21) to KB (11), and it also includes the following: - this TB (21)”Is YS ( 22), and these source calls are real calls, which are the international calls of these YS (22); or - these TB (21)members are KB (11) of countries other than the country of this OS (10), in which these source calls are international calls of OS (10) of OS (10) of KB (11) belonging to these other countries are real calls, in which OS (10) of other countries are configured to trigger all born international calls to their KB (11); or - these TB (21) are KB (11) of countries other than the country of this OS (10), in which these resource calls are the mentioned resource calls of KB (11) of these other countries; or - this TB (21) is any TÇUS (31) that generates correct test calls from YS (22) around the world to real subscriber numbers belonging to countries other than OS (10)'s country. It is the method of claim 2, characterized in that said TB (21) triggers said resource calls to at least one MDB (24) and these resource calls of this MDB (24) are fulfilled in claims 2 or 3 of OS (10). 's method, characterized in that said trigger is a communication regarding said call information, and this trigger also includes the following: - this communication includes sending a start message or sending a start message and at least one subsequent message, in which this trigger the start message contains said call information, which call information includes said AAN, ANB, country code of YS (22) of said source call, operator code of YS (22) of said origin call, start timestamp of start message, and/or the time zone of this timestamp, in which this subsequent message of this trigger contains said call information, which call information includes at least one or more of the AAN's ring notification, including notification of said resource call being answered, and/or said resource call termination notification; or - this communication is lNAP (Intelligent Network Application Protocol) or CAMEL (Customized Applications for Mobile network Enhanced Logic) signaling protocol, in which a start message of this trigger is SCCP (Signaling Connection and Control Part) GT ( Global Title), in which this is the SCF KB (11) or MDB (24) in which the initial message is the IDP (Initial Detection Point) message; or - this communication is SIP (Session Initiation Protocol), in which an initial message of this trigger is sent to an Application Server Name of an Application Service, in which the Application Server Name defines KB (11) or MDB (24), and in this start message - this communication is sent to the SRI (Send Routing address) of the MAP (Mobile Application Part) protocol, where said SCCP GT address is AAN and said start message is a MAP SRI message. in case the resource calls have AANs with the country code for the country of the OS (10), the transmission method of the said triggers also includes: - MDB (24) or TB (21) these resource calls can be used by the OS ( 10) “triggers each KB (11)” of “Items”; or - MDB (24) or TB (21) triggers these resource calls to each KB (11) in a country, which AANs of these resource calls this each KB OS of (10) of (11) umara is one of the area codes, in which each KB (11) cannot receive triggers for these resource calls whose AANs belong to their ported subscriber numbers, in which each KB (11) is an NT (Number Portability) query for the AAN as a result, if the subscription of the AAN belongs to its own OS (10), then it initiates said control of the AAN; or - MDB (24) or TB (21) a Lead KB (11) of a Lead OS (10) in a country to one of the number area codes of the OS (10) of other KB (11) in that country Except for the resource calls that have the AAN that has this country, AAN*II that has the country code of this country triggers for the said resource calls, other KB (11)'s are triggered for the number area codes belonging to their OS (10), which If the Pioneer KB (11) and other mentioned KB (11) mentioned in the above detect exported subscriptions for these AANs based on the answers of the NT queries they will make for the AANs belonging to the triggers they have received, if they detect the aforementioned start messages regarding these triggers they have received. forward to the KB (11) of the OS (10) that owns the subscriptions of these AANs; or - MDB (24) or TB (21) triggers a Central SAF (33) in a country for said source calls, this Central SAF (33) performs NT query for the AANs of said triggers it receives and it receives said initialization of these triggers forward their messages to KB (11) belonging to OS (10) that owns subscriptions of these AANs; or - to OS (10) whose triggers are mobile-type networks to which the subscriptions of these AANs belong, by performing a MAP SR1-SM (Send Routing Information for - Short Message) for MDB (24) or TB (21) AANs. forwards to the corresponding KB (11), in which the responses to these SRI-SM transactions report the OS (10) to which the subscriptions of these AANs belong in a country; or - MDB (24) or TB (21) by performing an NT query for this AAN from an NT Database (32) forwards said triggers to the KB (11) of the OS (10) to which the subscriptions of these AANs belong, which a country or an operator in that country provides access to said NT Database (32); or - MDB (24) or TB (21) perform an ENUM (E. query) for this AAN, forwarding said triggers to the KB (11) of the OS (10) to which the subscriptions of these AANs belong, in which this ENUM query is used to obtain the URL (Universal Resource Identifier) address of the OS (10) having the said subscription. triggering said resource calls to KB (11), in which it has international foreign numbers as the AAN of these triggers, which international foreign numbers have different country codes than the country code of OS (10), in which these international foreign numbers selection of the number sequences of numbers to be triggered by OS (10) of KB (11), where a predefined rate of these triggers is filtered by KB (11), MDB (24) and/or TB (21)”s. It is the method of claim 2, and its feature is that KB (11) processes the mentioned source calls of TB (21) adaptively as interconnection fraud detection is made on the basis of TB (21) and YSD (Foreign Network Destination) pair, and it also contains the following: - Determines the number of these source calls in the daily total that should be processed as triggers from KB (11) TB (21) and distributes this number over predefined equal time periods of a day, which is proportional to the average number of triggers received in the respective time periods during this day of the week makes; for each of these time slots, this distributed value of this total number is divided by the TBK (Trigger Unit Quota) values in proportion to the number of triggers received in each TB (21) and YSD pairs, in which these TBK values are recorded as default TBKs. where these default TBKs are the number of said resource calls that will be processed from each TB (21) and YSD pairs for each time slot; and - for each pair of TB (21) and YSD in this new time slot, KB (11) adaptively determines a new TBK, in which KB (11) is the TBK determined for this previous time slot, provided that this is a If at least one of the resource calls mentioned in the previous time slot is detected as interconnection fraud, it will adaptively increase it at a predefined rate, and KB (11) will set the TBK for this previous time slot, provided that this is one of the resource calls mentioned in the previous time slot. if none is detected as interconnection scam, it will adaptively attenuate at a predefined rate, in which these TBK, TB (21) and YSD pair, which are determined as adaptive in this time period, are determined by the predefined minimum and maximum rates of one each of the aforementioned predefined TBKs. may vary between The method of claim 1, characterized in that the source calls are test calls generated by KB (11) and these test calls call real subscriber numbers as AAN, wherein KB (11) chooses a YSO (Foreign Network Origin) for this test call and choosing an ANB from the real subscriber numbers in accordance with this selected YSO, in which this selected YSO specifies an elected YS (22) and that this elected ANB is assigned to this selected YS (22) is that it has a number from the numbering plan. The method of claim 8, characterized in that KB (11) generates these test calls via a TÇUS (31) and this TÇUS (31) generates its test calls from these selected YSOs, wherein KB (11)” this TÇUS (31) communicates the start and end requests of these test calls to this TÇUS (31) and this TÇUS (31) communicates the ring, answer and termination information of the test calls to KB (11). The method of claim 8, characterized in that KB (11) directly generates these test calls, KB (11) or OS (10) forwards these test calls as outbound international calls to one or more Selected Carriers (40), which is the Selected Carrier. Carrier 40 forwards these test calls it receives to selected Next Carriers 41, in which this Selected Carrier 40 maintains a list of mentioned YSOs for each of these Next Carriers 41, and wherein this list for each of these Next Carriers. The Carrier (41) indicates from which YSOs it carries traffic, and in which this Selected Carrier (40) selects these Next Carriers (41) if they have the YSO of this test call in their mentioned list, in which more than one Next Carrier (41) can be selected ), then this Selected Carrier (40) selects the Next Carriers (41) proportional to the traffic they carry from the YSO of this test call. The method of claim 9 or 10, characterized in that generating said test calls further includes: - said AANs of these test calls are selected from local subscriber numbers, which local subscriber numbers are the active subscriber numbers of real subscribers of OS (10); - MAP PRN (Provide Roaming Number) messages from UDOS (36)'s are transmitted over KB (11) in OS (10); In order to detect the Fraud Born in the Network, the AANs of these test calls are selected from the roaming subscriber numbers, which are the real subscribers of the UDOS (36) of OS (10) and actively roaming in the OS (10), KB (11) When it receives a MAP PRN message to this roaming subscriber number, it terminates this test call, and KB (11) resumes this incoming MAP PRN message to OS (10). The method of claim 8, wherein KB (11) generates directly mentioned test calls to subscriber numbers related to test SlM (Subscriber Identity Module) cards belonging to UDOS (36) of OS (10), in which each performing a location update operation by KB (11) for a test SIM card, selecting this subscriber number in accordance with the selected YSO, which this YSO selected subscriber number is its own network, generating these test calls also includes the following: - KB (11) returns an MSRN (Mobile Subscriber Roaming Number) parameter synchronized to a selected local subscriber number in response to a MAP PRN message it has received regarding this test call, which is an active real subscriber of a real subscriber of OS (10). is the number; or - OS (10) is configured to forward MAP PRN messages to KB (11) wherein these MAP PRN messages come from OS (10)'s UDOS (36); KB (11) returns an MSRN parameter synchronized to a selected Roaming Subscriber Number, in which this Roaming Subscriber Number OS (10) is sent to a real subscriber of a UDOS (36) in response to a MAP PRN message he has received regarding this test call. is a real subscriber number that belongs to and is actively roaming internationally in OS (10), wherein this selected Roaming Subscriber Number is selected from a country different from the country of UDOS (36) from which said selected subscriber number is selected; KB (11) terminates this test call when it receives a MAP PRN message to this Roaming Subscriber Number; and then KB (11) continues this incoming MAP PRN message to OS (10). The method of claim 8, characterized in that these test calls are generated based on said YSO adaptively according to the detection of interconnection fraud in order to accelerate the prevention of interconnection fraud, and it also includes the following; - KB (11) determines the total number of test calls per day to generate and distributes this number over the predefined equal time periods of the day, proportional to the international traffic data in the inbound direction received in OS (10); For each of these time periods, a predetermined YSK (Foreign Network Quota) is determined for each said YSO, in which the value of this predefined YSK will be proportional to the daily traffic received from said FSOs included in the said international traffic data, this is the number of test calls to be generated from each said YSO for each time slot; and - for each said YSO in each new said time slot, KB (11) adaptively determines a new YSK, wherein KB (11) this adaptively determined YSK of the previous time slot, said during that previous time slot If at least one of the test calls is detected as interconnection fraud, it will increase by a default rate, and similarly, if no interconnection fraud is detected during this previous time period, KB (11) will decrease by a default rate, for the time period mentioned in it said adaptively determined YSK value may take a value between a predefined minimum and a maximum ratio of said predefined YSK value belonging to said time period. The method of claim 8, characterized in that a CFU (Call Forwarding Unconditional) change is made in the subscription profile of said AAN, which forwards this AAN's incoming calls as forwarded calls to a test number, in which this AAN's CFU change is due to this AAN's undone upon completion of said check, in which this test number is transmitted to KB (11) in OS (10) and terminated at KB (11), in which this AAN belongs to a real subscriber of OS (10) is a local subscriber number that is an active real subscriber number, KB (11) associates these forwarded calls with this AAN, in which the forwarding party number of these forwarded calls is used as an association parameter with this AAN. The method of claim 1, 2, or 8, characterized in that said GYKK contains a Type Code, an Operator Code and an Operator Information, and also contains the following: - the value of this type code if said terminated call is received over an international interconnection route , as an absence value if this terminating call was received over a national interconnection route National, if this terminating call was a call originating on OS (10) Internally, or if this terminating call was received over other type internal routes or this Type Code does not receive a value Gets the value Internally Terminated; - A specific code value is assigned for each interconnection partner of OS (10) and for each national operator in the country of OS (10), this Operator Code this particular code assigned to the interconnection partner from which this terminated call was received in OS (10) is the value; - this Operator Information is the said Operator Code relating to the operator that has the subscription of the ANB of this terminated call, in which the operator holding this subscription is either any mentioned interconnection partner of OS (10) or any mentioned operator in the country of OS (10) is the national operator, in which KB (11) determines the operator holding this subscription by performing a NT query for said ANB. The method of claim 15, characterized in that KB (11) receives triggers from OS (10), KB (11) associates these triggers to said AAN and determines said terminating calls of this AAN, wherein these triggers using the called party numbers as the association parameter, determining at least one mentioned GYKK for each said associated trigger, KB (11) matching these determined GYKKs with this AAN, and also includes: - said trigger at least one It carries the Arrived Path Information, in which the Arrived Path Information is a special code value assigned for each different type of inbound route in OS (10), in which, in the trigger configurations of OS (10), this Arrived Call Information is pre-defined. configured and added as a parameter to these triggers; this Coming Path Information determines the mentioned Type Code and said Operator Code values of this GYKK; KB (11) determines this Type Code and this Operator Code values from this Traveling Path using a preconfigured mapping; and - carries said trigger ANB. The method of claim 16, characterized in that said triggers for said terminated calls are provided to KB (11) through a change made in the subscription profile of said AAN, this change is undone upon completion of said check of said AAN, in which this AAN' is a local subscriber number with an active real subscriber number belonging to a real subscriber of OS (10), where these triggers of terminated calls also include: - KB (11) is triggered as an Application Service with SIP, this in the subscriber profile the change includes an Application Service definition; said Incoming Route Information is the Operator carried FQDN (Fully Qualified Domain Name) or IP (Internet Protocol) addresses carried in the received-realm parameter in the Via header field of the SIP INVITE message; said ANB of this terminated call is carried in the Telephony URl parameter in the From header in the SIP INVITE message and said called party number is carried in the Telephony URI parameter in the To header in the SIP INVlTE message; The change in this subscriber profile includes a DH (Default Handling) parameter, which takes a value that means mandatory for said resource calls generated as said test calls, while it takes a value meaning non-mandatory for resource calls triggered from TB (21) ; or - KB (11) is triggered as an SCF with INAP or CAMEL protocol, said change in subscriber profile includes definition of an existing TDP (Trigger Detection Point) for calls terminating in INAP, said change in subscriber profile is in CAMEL protocol and this AAN's HLR ( It contains a T-CSI (Terminating Camel Service Information) definition defined in “35)”, The Incoming Path Information mentioned in INAP and CAMEL protocols is carried in the Service Key parameter of the IDP message, the mentioned ANB of this incoming call in the Calling Party Number parameter of the IDP message in the INAP and CAMEL protocols is carried and in the Called Party Number parameter of the IDP message, this said calling party number of this incoming call is carried. In the lNAP and CAMEL protocols, the change in this subscriber profile includes a DCH (Default Call Handling) parameter, which DCH value is mandatory for said source calls produced as said test calls. t from TB (21) Gets a value that means not required for tagged resource calls. The method of claim 17, characterized in that if OS (10) does not support the triggering of said AAN to KB (11) at AD (12) of said terminating calls, or if OS (10) is a non-mobile network, in that case, the received calls from interconnection routes. Moving the mentioned Route Arrived Information regarding incoming calls or the mentioned Route Arrived Information related to the spawn calls of OS (10) to SD (13) in at least one parameter field of the call carrier protocol, in which OS (10) transfers this parameter field to this call bearer. is configured to add it into the protocol, and that these triggers of these terminated calls also include the following: - if said triggers of SD (13) are with said INAP or said CAMEL protocol, then OS (10) will send a call to the calling party number of this call bearer protocol. adds a number prefix, the trigger configuration of SD (13) refers to this received number prefix corresponding to said transported Path Information. re assigns a Service Key value; or - if said triggers of SD (13) are said SIP, OS (10) adds said Operator Identifier, said FQDN and/or said IP address to INVITE message to be delivered to SD (13), SD ( 13) Moves these parameter fields directly to KB (1 1) in triggers. The method of claim 16, characterized in that if OS (10) does not support said AAN's triggering of said terminating calls to KB (11) in AD (12) or if OS (10) is a non-mobile network, then OS (10) )'s AD (12) is configured to trigger all incoming calls received from interconnection paths to KB (11) by signaling. It is the method of claim 16, the feature of which is to detect Network Scam, OS (10) is configured to trigger all native international calls to KB (11) by signaling. It is the method of claim 14 or 15, characterized in that the said AAN's mentioned GYKKs are determined through the related network RECs (Call Detail Record) and it also contains the following: - this AAN's related network RECs OS (10)' are obtained from a process of the OS (10), in which the process is fed from the charging system or the signaling monitoring system of the OS (10), the start timestamp of said source call and this AAN are sent to this process as association parameters, in which a prefix starting from this start timestamp is obtained. the defined time interval is used by this process as a time filter, which returns a list containing the associated network RFCs, in which each row in this list contains the parameters of the corresponding network RFC in columns; - the parameters Incoming Route Name and Calling Party Number from the network CDK for each of these are separated; - for this each associated network RCC, KB (11) determines the mentioned Type Code and said Operator Code values of this GYKK using a preconfigured mapping from this Inbound Route Name parameter, in which this Inbound Route Name corresponds to the mentioned Inbound Route Information corresponds; - for each associated network CDK, KB (11) determines the operator that has the subscription to this Calling Party Number by performing an NT query for this Calling Party Number, the value of said Operator Information of this GYKK is the said Operator of the operator holding this subscription The value of the code is assigned as; and - this GYKK of each associated network CDK is matched with this AAN. It is the method of claim 16 or 21, the feature of which is if the said AAN has any GYKK where the said Type Code value indicates Internal Born and if this AAN is an international foreign number, then the said terminated call of this GYKK is born in the said Network. It is detected as fraud and the ANB regarding this terminated call of GYKK is determined as the Fraud Number Born in the Network, in which the Fraud Number Born in this Network is recorded as the Detected Fraud Number. The method of claim 16 or 21, the feature of which is if the said AAN has any GYKK where the said Type Code value indicates Internal Born and if this AAN is a national subscriber number belonging to an OS (10), then this GYKK The said terminated call of 's is detected as the said Network Terminated Intra-Network Fraud and the ANB regarding this terminated call of this GYKK is determined as the Network Terminated Network Fraud Number, in which it is recorded as the Network Terminating Intra Network Fraud Number, Detection Number . It is the method of claim 16 or 21, the feature of which is if the said AAN has any GYKK where the said Type Code value indicates National, and if the said Operator Information and said Operator Code of this YYK are equal to each other, then this GYKK's said terminated call is detected as Off Network Fraud Terminating in the Network and the ANB regarding this terminated call of this GYKK is determined as the Out of Network Fraud Number Terminated in the Network, in which this Terminated Network Out of Network Fraud Number is recorded as Detected Fraud. The method of claim 22, 23 or 24, characterized in that it prevents said Detected Fraud Numbers from doing said interconnection fraud, and also includes the following: - KB (11) adds this Detected Fraud Number to a list, in which each Detection Number in this list The Fraud Number is automatically deleted from this list by KB (11) after a predefined period from its entry on this list, within which this default period starts again in case each Detected Fraud Number is detected again; if this Detected Fraud Number has been detected as a configurable number of consecutive Detected Fraud Numbers at the time it is active on this list, then a blocking flag will be activated on this list for this Detected Fraud Number; - if OS (10) has a subscription to this Detected Fraud Number, then you can enable the blocking of outbound and inbound calls for these Detected Fraud Numbers with the mentioned blocking flag in this list active via the subscription interface of KB (11) OS (10). activates; and - inbound calls from national interconnection directions are triggered in OS (10) to KB (11), provided that the triggering ANB for one of these inbound calls is found in this list as said Detected Fraud Number with the blocking flag active. , in this case KB (11) blocks the inbound call belonging to this trigger. The method of claim 16 or 21, characterized in that if said AAN has any GYKK where said Type Code value indicates International, then it also contains the following: - by virtue of OS (10) that said terminating call of this YYK's ANB' neither, if the said resource call imposes a lower interconnection fee than the original ANB, then this terminated call of this YYK is detected as said Inbound ANB Scam; and - if OS (10) does not impose a lower interconnection fee to the ANB of said terminated call of this AGB than the original ANB of said resource call, then this terminated call of this AGB is a normal termination and will be considered an interconnection scam. not detected. It is the method of claim 16 or 21, the feature of which is if the said AAN has any GYKK where the said Type Code value indicates National, and if the said Operator Information and said Operator Code of this YYK are not equal to each other, then this GYKK' said terminated call is identified as National Route Fraud in said Inbound Direction. The method of claim 26 or 27, if its feature is triggered by said source call TB (21) related to said terminated call, and if the GYKK of this terminated call is determined through the triggers of said AAN, then National Route Scam or Inbound It is the automatic blocking of said terminated calls detected as Inbound ANB Scam Scam by KB (11) and also includes the following: - if a subsequent message on this resource call reports a ring or answer for this resource call and only if this AAN's terminating call If a ring or answer is received within a pre-defined number of seconds for the call, then KB (11) will automatically terminate this ended call via the said trigger of this terminated call. The method of claim 22, 23, or 24, characterized in that, in order to recover possible accidental subscriber calls, if said source call is said test call and if said terminated call is detected as said Network Terminated Fraud or said Network Scam, then also the following: includes: - KB (11) terminates this test call; - after a predefined time after this termination, KB (11) resumes any said terminated call that is being held by KB (11) to connect to its AAN. The method of claim 26 or 27, characterized in that if said resource calls are said test calls, then, during said control of said AAN, an adaptive response method is applied to said terminated calls, in which said Type Code value of these terminating calls indicates International having said GYKK but not detected as said interconnection scam and/or these terminating calls were detected as Inbound Scam, this method also includes the following: - if any of these terminated calls were received with the original ANB, that - during the control of this AAN other said terminated calls that do not have this original ANB are detected as random subscriber calls and connected to the AAN; - KB (11) with this original ANB either terminates or answers this terminating call, in which a default response rate is configured for each mentioned YSO of these test calls, and KB (11), thanks to which the rate of test calls answered if this is lower than the default response rate for the said YSO, it will answer the terminated call; - if none of these terminated calls were received with the original ANB for this test call for at least one predefined period from the start of this test call, and any of these terminated calls are different from this original ANB during the control of this AAN if the value of an Adaptive Answer Flag is False for said YSO and said Operator Code pair, then: - KB (11) terminates this test call and waits for a preset timeout period to expire; - if these terminated calls are not terminated by this timeout, then these terminated calls are detected as random subscriber calls and are connected to this AAN by KB (11); and - if these terminating calls are terminated by this timeout, then KB (11) increments the value of an Termination Counter for said pair by one; - if the value of this Adaptive Answer Flag is True for this YSO and this Operator Code pair, then: - KB (11) answers this terminating call with a random duration between a preconfigured minimum and maximum value; - the value of this Termination Counter for said pair is incremented by one if KB (11) detects a duplex establishment for this answered test call, or decremented by one if KB (11) does not detect a duplex establishment; and - for these answered calls randomly selected telephone conversation recordings are played, in which KB (11) plays the caller side of this recording on the emerging leg of this test call and KB (11) plays the called side of this recording on this terminated call side, in which these recordings are played over time they are updated. The method of claim 30, characterized in that KB (11) determines the value of said Adaptive Reply Flag by calculating a Termination Rate and a Response Rate for each said YSO and said Operator Code pair independently of other said pairs, in which this YSO is said YSO of said test call and this Operator Code belongs to said GYKK of said terminating call, in which this calculation is performed on each termination or answer of this test call from each pair, further comprising: - thanks if said End Counter has never been incremented for a predefined period, or if a preconfigured time has elapsed since the last reset of this End Counter, then the values of this End Counter, a Test Call Counter, and an Answer Counter are reset, in which this Test Call Counter KB (11 ) counts these test calls, in which b u Answer Counter counts these test calls answered by KB (11); - said Termination Rate and said Response Rate are calculated if this Test Call Counter is greater than a predefined number, in which this Termination Rate is the ratio of this Termination Counter to this Test Call Counter, in which this Response Rate is the ratio of this Answer Counter to this Test Call Counter; - KB (11) keeps the value of this Adaptive Response Flag at True as long as this Termination Rate is higher than a pre-configured default threshold value for said YSO; and - KB (11) keeps the value of this Adaptive Response Flag on False as long as this Response Rate is higher than a pre-configured predefined threshold value for said RSO, in which this Response Rate depends on this Termination Rate in determining the value of this Adaptive Response Flag. has priority. It is a system for preventing interconnection fraud in a telecommunication OS (10), comprising a KB System whose feature is configured as follows: - uses call information of source calls; - it checks the AAN of each source call during this each source call, in which this KB System is configured to check the terminating calls of this AAN, in which this AAN is a real subscriber number; - during the control of this AAN it determines at least one GYKK for each terminating call, in which this KB System is configured to match these determined GYKK's with this AAN; and - detects and prevents Inbound ANB Spoofing Scam, Inbound National Route Scam, Inbound Scam, Network Terminated Inline Scam and/or Network Terminated Offline Scam by analyzing these identified GYKKs of this AAN. It is the system of claim 32, the feature of which is that the TB (21)'s are configured to trigger said call information of said source calls as triggers to said KB System, these TB (21)'s also contain the following: - these TB (21)'s of the world are the YS (22) all around him, and these source calls are the real calls that are the international calls of these YS (22); or - these TB (21)'s are these KB Systems belonging to countries other than the country of this OS (10), in which these source calls are the international calls of OS (10) of these KB Systems belonging to these other countries, in which these other OS (10) of countries are configured to trigger all emerging international calls to their KB Systems; or - these TB (21)'s are these KB Systems belonging to countries other than the country of these OS (10), in which these resource calls are said resource calls of these other countries' KB Systems; or - these TBs (21) are any TÇUS (31) that generates accurate test calls from YS (22)'s around the world to real subscriber numbers belonging to countries other than OS (10)'s country. The system of claim 32 or 33, characterized in that the MDB (24) is configured as follows: - it provides a central communication between said KB Systems of TBs (21) and OS (10)'s around the world; and - TB (21)) receives said triggers of said resource calls and triggers these resource calls to these KB Systems of OS (10). The system of claim 32, characterized in that said KB System is also configured to generate these resource calls as test calls to call real subscriber numbers as said AANs, in which this KB System signals these test calls to International Traffic Carriers (25). and is configured to generate directly or through the OS (10) using carrier protocols. 36. The system of claim 32, characterized in that a TÇUS (31) is configured as follows: - generates said source calls using test probes, robots and i'or 5 call services from around the world; - receives requests to initiate and terminate these test calls from said KB System; and - sends ring, answer and/or end information for these test calls to this KB System.