WO2013174416A1

WO2013174416A1 - Network usage event data record handling

Info

Publication number: WO2013174416A1
Application number: PCT/EP2012/059429
Authority: WO
Inventors: Leonid KHOKHLOV; Parag PADHYE; Sami GHARRES
Original assignee: Nokia Siemens Networks Oy
Priority date: 2012-05-22
Filing date: 2012-05-22
Publication date: 2013-11-28

Abstract

Communication systems, such as the long term evolution (LTE) of the third generation partnership project (3GPP), may benefit from efficient handling of usage event data record (xDR) compression. For example, such xDR compression can be used to reduce load generated by for example data traffic for revenue assurance (RA) and fraud management (FM) systems. A method according to certain embodiments comprises receiving raw network extended data records for at least one of a call or a data stream. The method also comprises compressing the raw network usage event data records. The method further comprises generating as output at least one extended data record corresponding to a plurality of the raw network usage event data records, wherein the one extended data record contains detailed information for a system, for example a fraud management system and/or revenue assurance system.

Description

DESCRIPTION TITLE

Network Usage Event Data Record Handling

BACKGROUND: Field:

[0001] Communication systems, for example such as the long term evolution (LTE) of the third generation partnership project (3GPP), may benefit from efficient handling of usage event data records (for example xDR). Such usage event data records may be generated by data traffic and may be processed by for example for revenue assurance (RA) and fraud management (FM) systems.

Description of the Related Art:

[0002] Mobile communication services providers continuously introduce new products and services to retain their existing subscribers as well as to attract new ones. Moreover, increasing access speeds and data rates also encourage subscribers to consume larger amounts of data, open more and longer data sessions, and therefore produce a higher number of xDRs.

[0003] As shown in Figure 1 , existing RA and FM systems 120 collect, load, and analyze xDRs from network elements such as a serving general packet radio service (GPRS) support node (SGSN)/ gateway GPRS support nodes (GGSN) /packet gateway (P-GW) 1 10, in order to detect revenue losses due fraudulent behavior or leakages. The cost of the hardware of such systems can often be the majority of the cost of the approach. Consequently, these systems may be dimensioned close to their maximum capacity with a small extra capacity for slow incremental data growth. When the maximum processing and storage capacity of RA and FM systems is exceeded, the systems cannot provide the required protection against fraud and RA leakages. Thus, operators may need to make significant additional capital expenditures (CAPEX) to expand system capacities and associated infrastructure to cope with such increase in data volumes However, such CAPEX expenditures may yield low return on investment (ROI), as operators may need to spend significant amounts of CAPEX to obtain significant improvements in performance. In addition, operators may need to pay more for licenses, for example in cases where RA and FM systems' licenses depend on the number of xDRs processed by these systems. [0004] As shown in Figure 2, fraud management (FM) / revenue assurance (RA) systems can operate by taking xDRs as input from several different network elements such as for example mediation devices 130, serving general packet radio service (GPRS) support node (SGSN), mobile switching center (MSC) server (MSS), gateway GPRS support node (GGSN), serving gateway (S-GW), and packet gateway (P-GW) 1 10. The FM/RA system can then analyze the data and process it with respect to subscriber/traffic behavior.

[0005] Historically, FM/RA systems utilize a straightforward approach, namely taking all incoming records, processing them, and loading them into a database for analysis and reporting. Licensing approach of product vendors may be based on the input CDR volumes.

[0006] Figures 1 and 2 show typical xDR collection processes by FM/RA systems, according to two options. In general, xDRs are produced by the network elements and are used for example for off line charging processes.

[0007] These xDRs can either be sent with no delay to the FM/RA system, or they can be sent with a delay that may be on the order of hours. For example, when no mediation device is used, or the mediation device passes on the records on a one-to-one basis, there may be negligible delay. On the other hand, if the mediation provides the records on a one session- to-one basis, the delay can be hours long, particularly if the session itself is long.

[0008] As described above, the data volume may grow due to factors that include increasing usage of smart devices, such as for example smart phones, tablets, and the like, as well as new technology like LTE, increase coverage of mobile broadband, higher bandwidth, longer or never-ending sessions such as those of always on devices, more frequent xDR generation for hot billing purposes, and so on.

[0009] The additional growth in the data volumes may itself have no impact on the existing FM/RA processes from a coverage perspective. However, in order to cope with increased xDR volumes, RA/FM systems may require extended product licenses, extra storage or reduced record retention and analysis window, extra central processing unit (CPU) power, and proportionally increased support.

[0010] Thus, conventionally a communication service provider (CSP) must decide whether to invest in significant CAPEX and operational expenditure (OPEX) to enhance RA/FM systems to cope with the data volume, or to discontinue or downgrade the quality of RA/FM systems.

[001 1] For example, the configuration of packet switched (PS) network elements, like SGSN/GGSN or S-GW/P-GW, may be adjusted to change thresholds/rules for xDR generation. Another alternative may be to implement xDR stitching on the mediation device for each data session. This is traditionally used for long voice calls, but may not be applicable for data because data sessions can have long durations, even never ending duration. Therefore, a complete CDR may take a lengthy time period, or a complete CDR may never be produced.

SUMMARY: [0012] According to a first embodiment, a method may comprise receiving raw network usage event data records for at least one of a call or a data stream. The method may also comprise compressing the raw network usage event data records. The method may further comprise generating as output at least one extended data record corresponding to a plurality of the raw network usage event data records, wherein the at least one extended data record may contain detailed information to be transmitted to a system for further processing.

[0013] The method according to the first embodiment, where the system may be one of fraud management system and a revenue assurance system.

[0014] The compressing may be performed on the fly according to configured rules.

[0015] The method according to the first embodiment may also comprise aggregating the plurality of usage event data records in the at least one extended data record based on measures selected from session duration, count of files, count of sessions, count of initial xDRs, data volume (uplink, downlink or total).

[0016] The method may further comprise setting at least one threshold with respect to at least one counter of the usage event data records, wherein the at least one counter may relate to at least one of file count, records count, session count, duration amount, or data volume amount (uplink, downlink or total).

[0017] The generating may be performed when the at least one threshold is exceeded.

[0018] The method according to the first embodiment may also comprise incrementing the at least one counter based on a newly received usage event data record.

[0019] The method may further comprise flagging at least one behavior in a network, wherein the generating may be performed based on a flag rule violation.

[0020] The flagging may be responsive to at least one of an access network change, an access point name change, a quality of service change, a mobile subscriber integrated services digital network number change, international mobile equipment identity change, or location change.

[0021] The flag rule violation may be based on a combination of a plurality of flags being changed.

[0022] The generating may be performed upon the expiration of a timer.

[0023] An apparatus, according to a second embodiment, may comprise at least one processor and at least one memory comprising computer program code. The at least one memory and the computer program code may be configured to, with the at least one processor, cause the apparatus at least to receive raw network usage event data records for at least one of a call or a data stream. The at least one memory and the computer program code may be also configured to, with the at least one processor, cause the apparatus at least to compress the raw network usage event data records. The at least one memory and the computer program code may be further configured to, with the at least one processor, cause the apparatus at least to generate as output at least one extended data record corresponding to a plurality of the raw network usage event data records, wherein the at least one extended data record contains detailed information to be transmitted to a system for further processing.

[0024] The apparatus according to the second embodiment, where the system may be one of a fraud management system and a revenue assurance system.

[0025] The at least one memory and the computer program code according to the second embodiment may be configured to, with the at least one processor, cause the apparatus at least to compress the usage event data records on the fly according to configured rules.

[0026] The at least one memory and the computer program code may also be configured to, with the at least one processor, cause the apparatus at least to aggregate the plurality of usage event data records in the at least one extended data record based on measures selected from session duration, count of files, count of sessions, count of initial xDRs, data volume (uplink, downlink or total).

[0027] The at least one memory and the computer program code may be configured to, with the at least one processor, cause the apparatus at least to set at least one threshold with respect to at least one counter of the usage event data records, wherein the at least one counter may relate to at least one of file count, records count, session count, duration amount, or data volume amount.

[0028] The at least one memory and the computer program code may be configured to, with the at least one processor, cause the apparatus at least to generate the output extended data record when the at least one threshold is exceeded.

[0029] The at least one memory and the computer program code may be configured to, with the at least one processor, cause the apparatus at least to increment the at least one counter based on a newly received usage event data record.

[0030] The at least one memory and the computer program code may be configured to, with the at least one processor, cause the apparatus at least to flag at least one behavior in a network, wherein the at least one memory and the computer program code may be configured to, with the at least one processor, cause the apparatus at least to generate the output extended data record based on a flag rule violation.

[0031] The at least one memory and the computer program code may be configured to, with the at least one processor, cause the apparatus at least to flag responsive to at least one of an access network change, an access point name change, a quality of service change, a mobile subscriber integrated services digital network number change, international mobile equipment identity change, or location change.

[0032] The flag rule violation may be based on a combination of a plurality of flags being changed.

[0033] The at least one memory and the computer program code may be configured to, with the at least one processor, cause the apparatus at least to generate the output extended data record upon the expiration of a timer.

[0034] In a third embodiment, an apparatus may comprise receiving means for receiving raw network usage event data records for at least one of a call or a data stream. The apparatus may also comprise compressing means for compressing the raw network usage event data records. The apparatus may further comprise generating means for generating as output at least one usage event data record corresponding to a plurality of the raw network usage event data records, wherein the at least one extended data record may contain detailed information transmitted to a system for further processing.

[0035] The apparatus according to the third embodiment, where the system may be one of a fraud management system and a revenue assurance system.

[0036] The compressing may be performed by the apparatus according to the third embodiment on the fly according to configured rules.

[0037] The apparatus may also comprise aggregating means for aggregating the plurality of usage event data records in the at least one usage event data record based on measures selected from session duration, count of files, count of sessions, count of initial xDRs, data volume (uplink, downlink or total).

[0038] The apparatus may further comprise threshold means for setting at least one threshold with respect to at least one counter of the usage event data records, wherein the at least one counter may relate to at least one of file count, records count, session count, duration amount, or data volume amount.

[0039] The generating may be performed by the apparatus when the at least one threshold is exceeded.

[0040] The apparatus may also comprise incrementing means for incrementing the at least one counter based on a newly received usage event data record.

[0041] The apparatus may further comprise flagging means for flagging at least one behavior in a network, wherein the generating may be performed based on a flag rule violation.

[0042] The flagging may be be responsive to at least one of an access network change, an access point name change, a quality of service change, a mobile subscriber integrated services digital network number change, international mobile equipment identity change, or location change.

[0043] The flag rule violation may be based on a combination of a plurality of flags being changed.

[0044] The generating may be performed by the apparatus upon the expiration of a timer.

[0045] A non-transitory computer readable medium, in a fourth embodiment, may be encoded with instructions that, when executed in hardware, may perform a process. The process may comprise receiving raw network usage event data records for at least one of a call or a data stream. The process may also comprise compressing the raw network usage event data records. The process may further comprise generating as output at least one extended data record corresponding to a plurality of the raw network usage event data records, wherein the at least one extended data record may contain detailed information for transmission to a system for further processing.

[0046] The non-transitory computer readable medium according to the fourth embodiment, where the system may be one of a fraud management system and a revenue assurance system.

[0047] In the process, the compressing may be performed on the fly according to configured rules.

[0048] The process may also comprise aggregating the plurality of usage event data records in the at least one extended data record based on measures selected from session duration, count of files, count of sessions, count of initial xDRs, data volume (uplink, downlink or total).

[0049] The process may further comprise setting at least one threshold with respect to at least one counter of the usage event data records, wherein the at least one counter may relate to at least one of file count, records count, session count, duration amount, or data volume amount.

[0050] In the process, the generating may be performed when the at least one threshold is exceeded.

[0051] The process may additionally comprise incrementing the at least one counter based on a newly received usage event data record.

[0052] The process may further comprise flagging at least one behavior in a network, wherein the generating may be performed based on a flag rule violation.

[0053] In the process, the flagging may be responsive to at least one of an access network change, an access point name change, a quality of service change, a mobile subscriber integrated services digital network number change, international mobile equipment identity change, or location change. [0054] In the process, the flag rule violation may be based on a combination of a plurality of flags being changed.

[0055] In the process, the generating may be performed upon the expiration of a timer.

BRIEF DESCRIPTION OF THE DRAWINGS:

[0056] For proper understanding of the invention, reference should be made to the accompanying drawings, wherein:

[0057] Figure 1 illustrates an architecture of integration of an FM/RA system with data source according to a first option.

[0058] Figure 2 illustrates an architecture of integration of an FM/RA system with data source according to a second option.

[0059] Figure 3 illustrates an architecture of integration of an FM/RA system with a data source according to certain embodiments.

[0060] Figure 4 illustrates detailed method of an xDR compression technique according to certain embodiments.

[0061] Figure 5 illustrates a method according to certain embodiments.

[0062] Figure 6 illustrates a system according to certain embodiments.

[0063] Figure 7 illustrates a data flow according to certain embodiments.

[0064] Figure 8 illustrates data processing and aggregation according to certain embodiments.

[0065] Figure 9 illustrates an apparatus according to certain embodiments.

DETAILED DESCRIPTION:

[0066] In the following description the term xDR is used as an example for a network usage event data record. Certain embodiments of the present invention can be used for data traffic, however certain embodiments may also be used with other traffic types like, for example, voice traffic.

[0067] Certain embodiments may be used with any communication services provider (CSP) traffic chain or reporting system that 1 ) may be based on network usage event records (for example xDRs); 2) may be allowed to have some extra delays of incoming data; 3) may not be interested to keep all detailed event records, but for which it may be important to have accurate usage information 4) may still require indicative details about subscriber behavior. It can be used for example with fraud management (FM) and revenue assurance (RA) systems to help such systems handle growing xDR volumes due to data traffic in networks such as the GPRS, third generation (3G), and LTE networks, as well as with CSP reporting systems and also with Interconnect settlement systems or any other wholesale billing systems that do not require near real time charging and in which delays are acceptable. Certain embodiments manage the data xDR volume and reduce the data xDR volume passed to fraud management and revenue assurance applications for processing and storage.

[0068] Accordingly, certain embodiments may reduce overall total cost of ownership (TCO) for a communication services provider (CSP) while maintaining the effectiveness of the fraud management and revenue assurance tools and processes.

[0069] Taking into account real demands of FM/RA systems/processes, certain embodiments implement compression of an input xDR stream from the network and manage the data input to the FM/RA system. Thus, certain embodiments can permit the FM/RA system effectively to process an increased volume of raw xDRs without increasing hardware requirements of the RA/FM system.

[0070] Certain embodiments may also be used in connection with other systems that need to process a lot of network usage event data records. Thus embodiments of the invention may also apply to social networks where such systems may be implemented, as well as, for example, to processing information related to social network usage. In detail, as shown in Figure 3, a pre-mediation system for xDR compression 310 can take original, raw network xDRs for a data stream, can compress them on the fly according to configured rules, and can generate as output one or more xDR out of many that still contains detailed information, and optionally aggregated by measures like duration, volume, and the like if needed, for example for fraud management/revenue assurance system. The set of information fields as well as events for this output xDR generation may be specifically address fraud management/revenue assurance needs and do not need to depend directly on the charging/billing system requirements. "On the fly," here, can refer to a process that takes a matter of minutes to complete. However, the time can be configured, and can depend on the amount of aggregation desired.

[0071] As a result of such compression, a network operator may achieve a desired aggregation ratio of a manageable number of input xDRs for the system as a trade-off with acceptable information delay.

[0072] Figure 3 illustrates a system according to certain embodiments, in which an xDR compression device receives raw xDRs from for example the SGSN/GGSN/P-GW and provides them to the FM/RA system, with a configurable delay, which may be on the order of minutes. The aggregation can be in a ratio of N to 1 , where N is configurable as well.

[0073] The FM/RA systems may assume that information having the following characteristics is being provided by the network in xDR. The information received by FM/RA is complete enough to permit analysis of total network usage and to permit the system to see a complete picture of subscriber behavior. For example, all meaningful, detailed information about subscriber behavior can be kept in the output of the xDR compression. Meaningful, detailed information may comprise any international mobile equipment identity (IMEI), location, reconnect attempts, and the like. Also, any change in meaningful information, such as any change to for example fields within xDR, may be forwarded to the FM/RA system immediately. Certain embodiments can provide such information, while not requiring the sizing of FM/RA system to be affected by growing xDR volumes from the network. Moreover, certain embodiments can particularly provide for data xDRs.

[0074] For example, certain embodiments aggregate the incoming xDRs by calculation of summary information for network usage measures, such as number of files, number of xDRs, number of sessions, network resource usage duration, usage data as to uplink/downlink volume, and the like. Moreover, certain embodiments provide, as an output, a partial xDR containing accumulated measures based on the change of meaningful for FM/RA information fields as well as based on configured thresholds for each of the measures.

[0075] As a result of certain embodiments, an operator may achieve a required aggregation ratio comprising a manageable number of input xDRs for the system as a trade-off with acceptable information delay.

[0076] Figure 4 illustrates a method according to which certain embodiments may be implemented. This illustrates examples of techniques that can be used. Not all of the techniques shown are required, and additional techniques may be also permitted. For example, other counters than those shown can be defined if other things are desired to be measured.

[0077] At 410, network xDRs can be collected in memory and may be assigned based on a subscriber unique identifier (ID), such as for example an international mobile subscriber identity (IMSI). All the detailed information in the xDR fields may be stored and may be kept available, in case the system decides that an output xDR is to be generated and presented to the RA/FM application.

[0078] Counters 420 may be set to store all the quantifiable measures of xDR such as for example a file counter, an xDR counter, session counter, a duration counter, and data volume uplink (U) downlink (D) counter. These counters may get updated/incremented dynamically using incrementers 430. Flaggers 440, may create a change flag status, which may indicate any change to the xDR detailed fields in the incoming xDR. The flags may be updated if the corresponding field value is changed.

[0079] Output xDR, which may be presented to the FM/RA system by an output 450, may be generated on various conditions. For example, an output xDR may be generated when a counter number may cross a particular threshold, when a change flag may get triggered, or when an idle timeout event may occur. The idle time out can be configured as a maximum delay, for the case when there are no new xDRs coming for particular subscriber, for a period of time.

[0080] By configuring counter threshold settings and change flags rules, it is possible to manage an aggregation ratio, input to output, and also to manage average delay for output xDR.

[0081] Change flags rule may be as simple as a Boolean OR function. Thus, xDR may be generated immediately when a change flag is set. The rules may also alternatively require a logical combination of change flags. Requiring a combination of flags may permit the system to achieve a higher aggregation ratio, while suppressing change details for less priority fields.

[0082] Certain embodiments, therefore, can manage high data volume to the FM/RA system by, for example, cutting the volume onto multiple partial xDRs. Certain embodiments, therefore, can be ready for LTE, as to the FM/RA. Moreover, long or never ending data sessions do not need to burden the RA/FM applications with multiple repetitive xDRs or increase identification delay.

[0083] Likewise, frequent short low volume sessions, such as reconnect attempts, machine-to-machine (M2M) interactions, and the like, may not need to flood the FM/RA system with multiple unnecessary or unhelpful xDRs. Unexpected change of xDR generation rules on the network elements, due to for example marketing/off line charging requirements or network performance issues for example, do not need to affect FM/RA processes, as all the changes to the business rules may be implemented outside the RA/FM systems.

[0084] Figure 5 illustrates a method according to certain embodiments. The method of Figure 5 may be performed, for example, by an xDR compression device, which may be a pre-mediation device. As shown in Figure 5, the method can comprise, at 510, receiving raw network usage event data records for at least one of a call or a data stream. By "raw," here it is simply meant to distinguish the input usage event data records from the output data records.

[0085] The method can also comprise, at 520, compressing the raw network usage event data records. The compressing may be performed in a variety of ways. For example, the compressing may be configured to achieve a predetermined ratio of raw usage event data records to output extended data records. The compressing may be performed on the fly according to configured rules.

[0086] The method can further comprise, at 530, generating as output at least one extended data record corresponding to a plurality of the raw network usage event data records, wherein the one extended data record may contain detailed information for example for a fraud management system or a revenue assurance system. The generating may be performed upon the expiration of a timer. In some cases, M data records can be provided as output based on N received raw network usage event data records, for example xDRs, where M is less than N.

[0087] The method may additionally comprise, at 540, aggregating the plurality of usage event data records in the at least one extended data record based on, for example, measures selected from session duration, count of files, count of sessions, count of initial xDRs, data volume (uplink, downlink or total).

[0088] The method may also comprise, at 550, setting at least one threshold with respect to at least one counter of the usage event data records, wherein the at least one counter may relate to at least one of for example file count, records count, session count, duration amount, or data volume amount. The generating may be performed when the at least one threshold is exceeded. The method may also comprise, at 555, incrementing the at least one counter based on a newly received usage event data record.

[0089] The method may additionally comprise, at 560, flagging at least one behavior in a network, wherein the generating may be performed based on a flag rule violation. The flagging may be responsive to at least one of for example an access network change, an access point name change, a quality of service change, a mobile subscriber integrated services digital network number change, international mobile equipment identity change, or location change. The flag rule violation may be based on a combination of a plurality of flags being changed.

[0090] Figure 6 illustrates a system according to certain embodiments of the invention. In one embodiment, a system may comprise several devices, such as, for example, SGSN / GGSN / P-GW 610, FM/RA system 620, and xDR compression 630. Each of these devices may comprise at least one processor, respectively indicated as 614, 624, and 634. At least one memory is provided in each device, and indicated as 615, 625, and 635, respectively. The memory may comprise computer program instructions or computer code contained therein. Transceivers 616, 626, and 636 may be provided, and each device may also comprise an antenna, respectively illustrated as 617, 627, and 637. Other configurations of these devices, for example, may be provided. For example, SGSN / GGSN / P-GW 610, FM/RA system 620, and xDR compression 630 may be configured for wired communication, rather than wireless communication, and in such a case antennas 617, 627, and 637 would illustrate any form of communication hardware, without requiring a conventional antenna.

[0091] Transceivers 616, 626, and 636 may each, independently, be a transmitter, a receiver, or both a transmitter and a receiver, or a unit or device that may be configured both for transmission and reception.

[0092] Processors 614, 624, and 634 may be embodied by any computational or data processing device, such as a central processing unit (CPU), application specific integrated circuit (ASIC), or comparable device. The processors may be implemented as a single controller, or a plurality of controllers or processors.

[0093] Memories 615, 625, and 635 may independently be any suitable storage device, such as a non-transitory computer-readable medium. A hard disk drive (HDD), random access memory (RAM), flash memory, or other suitable memory may be used. The memories may be combined on a single integrated circuit as the processor, or may be separate therefrom. Furthermore, the computer program instructions stored in the memory and which may be processed by the processors can be any suitable form of computer program code, for example, a compiled or interpreted computer program written in any suitable programming language.

[0094] The memory and the computer program instructions may be configured, with the processor for the particular device, to cause a hardware apparatus such as SGSN / GGSN / P-GW 610, FM/RA system 620, and xDR compression 630, to perform any of the processes described above (see, for example, Figures 4 and 5). Therefore, in certain embodiments, a non-transitory computer-readable medium may be encoded with computer instructions that, when executed in hardware, perform a process such as one of the processes described herein. Alternatively, certain embodiments of the invention may be performed entirely in hardware.

[0095] Furthermore, although Figure 6 illustrates a system comprising a SGSN / GGSN / P- GW 610, FM/RA system 620, and xDR compression 630, embodiments of the invention may be applicable to other configurations, and configurations involving additional elements, as described herein.

[0096] Figure 7 illustrates a data flow according to certain embodiments. As shown in Figure 7, incoming network usage event data record (for example xDR) 710 may comprise event timestamp details and usage detailed information such as for example subscriber parameters like MSISDN, IMSI, IMEI, access network, APN, session Id, QCI, location, and the like. The incoming network usage event (xDR) data record 710 may also comprise usage amount data like, duration and uplink/downlink volume.

[0097] An apparatus 720 may produce a timestamp corresponding to the last incoming xDR and may assign it to an outgoing extended data record 730. Moreover, the apparatus 720 may keep details from previous records, may compare the details with a new record, and may react if a parameter is changed and/or if a flag is raised. Additionally, the apparatus 720 may accumulate/aggregate measures of usage and may react if a threshold is exceeded. [0098] The outgoing extended data record 730 may comprise the last event timestamp details, as well as a new set of details after a change is detected. The outgoing extended data record 730 may also comprise an accumulated usage amount and accumulators for record count, file count, session count, and the like. A further processing system 740, such as a fraud management system (FMS) or revenue assurance (RA) system may further process the data provided from the apparatus 720 in the outgoing extended data record 730.

[0099] Figure 8 illustrates data processing and aggregation according to certain embodiments. As shown in Figure 8, there may be N incoming xDRs 710, namely incoming xDR 1 , incoming xDR 2, incoming xDR 2, ... incoming xDR AM, and incoming xDR N. An xDR compression device may create outgoing record 730. The outgoing record 730 may have the event timestamp details from the Afth xDR. Moreover, the new set of details after a change occurs may also be taken the Afth xDR. An accumulated usage amount in the outgoing record 730 may be or may reflect a sum of the usage amount data from the 1 ^st to the Afth xDR. Moreover, other accumulators in the outgoing record 730 may be based on data throughout the incoming xDRs 710, and may comprise things like record count (A/), file count, and/or session count.

[0100] Figure 9 illustrates an apparatus according to certain embodiments. The apparatus of Figure 9 may be, for example, an xDR compression device, which may be a mediation or pre-mediation device 900. As shown in Figure 9, the apparatus may comprise receiving means 910 for receiving raw network usage event data records for at least one of a call or a data stream.

[0101] The apparatus may also comprise compressing means 920 for compressing the raw network usage event data records. The compressing may be performed in a variety of ways. For example, the compressing may be configured to achieve a predetermined ratio of raw usage event data records to output extended data records. The compressing may be performed on the fly according to configured rules.

[0102] The apparatus may further comprise generating means 930 for generating as output at least one extended data record corresponding to a plurality of the raw network usage event data records, wherein the one extended data record may contain detailed information for example for a fraud management system or a revenue assurance system. The generating may be performed upon the expiration of a timer.

[0103] The apparatus may additionally comprise aggregating means 940 for aggregating the plurality of usage event data records in the at least one extended data record based on, for example, measures selected from session duration, count of files, count of sessions, count of initial xDRs, data volume (uplink, downlink or total).

[0104] The apparatus may also comprise threshold means 950 for setting at least one threshold with respect to at least one counter of the usage event data records, wherein the at least one counter may relate to at least one of for example file count, records count, session count, duration amount, or data volume amount. The generating may be performed when the at least one threshold is exceeded. The apparatus may also comprise incrementing means 955 for incrementing the at least one counter based on a newly received usage event data record.

[0105] The apparatus may additionally comprise flagging means 960 for flagging at least one behavior in a network, wherein the generating may be performed based on a flag rule violation. The flagging may be responsive to at least one of for example an access network change, an access point name change, a quality of service change, a mobile subscriber integrated services digital network number change, international mobile equipment identity change, or location change. The flag rule violation may be based on a combination of a plurality of flags being changed.

[0106] One having ordinary skill in the art will readily understand that the invention as discussed above may be practiced with steps in a different order, and/or with hardware elements in configurations which are different than those which are disclosed. Therefore, although the invention has been described based upon these preferred embodiments, it would be apparent to those of skill in the art that certain modifications, variations, and alternative constructions would be apparent, while remaining within the spirit and scope of the invention. In order to determine the metes and bounds of the invention, therefore, reference should be made to the appended claims.

Claims

WE CLAIM:

1. A method, comprising: receiving raw network usage event data records for at least one of a call or a data stream; compressing the raw network usage event data records; and generating as output at least one extended data record corresponding to a plurality of the raw network usage event data records, wherein the at least one extended data record contains detailed information to be processed by a system.

2. The method of claim 1 , further comprising transmitting the at least one extended data record to the system.

3. The method of claim 1 or 2, wherein the system is one of a fraud management system and a revenue assurance system.

4. The method of any of the preceding claims, wherein the compressing is performed on the fly according to configured rules.

5. The method according to any of the preceding claims, further comprising: aggregating the plurality of usage event data records in the at least one extended data record based on measures selected from session duration, count of files, count of sessions, count of initial xDRs, data volume (uplink, downlink or total).

6. The method according to any of the preceding claims, further comprising: setting at least one threshold with respect to at least one counter of the usage event data records, wherein the at least one counter relates to at least one of file count, records count, session count, duration amount, or data volume amount.

7. The method of claim 6, wherein the generating is performed when the at least one threshold is exceeded.

8. The method according to claim 6 or 7, further comprising: incrementing the at least one counter based on a newly received usage event data record.

9. The method according to any of the preceding claims, further comprising: flagging at least one behavior in a network, wherein the generating is performed based on a flag rule violation.

10. The method of claim 9, wherein the flagging is responsive to at least one of an access network change, an access point name change, a quality of service change, a mobile subscriber integrated services digital network number change, international mobile equipment identity change, or location change.

1 1. The method according to any of the claims 9 or 10, wherein the flag rule violation is based on a combination of a plurality of flags being changed.

12. The method according to any of the preceding claims, wherein the generating is performed upon the expiration of a timer.

13. An apparatus, comprising: receiving means for receiving raw network usage event data records for at least one of a call or a data stream; compressing means for compressing the raw network usage event data records; and generating means for generating as output at least one extended data record corresponding to a plurality of the raw network usage event data records, wherein the at least one extended data record contains detailed information to be processed by a system.

14. The method of claim 1 , further comprising transmitting the at least one extended data record to the system.

15. The apparatus of claim 13 or 14, wherein the system is one of a fraud management system and/or revenue assurance system.

16. The apparatus of any of claims 13-15, wherein the compressing is performed on the fly according to configured rules.

17. The apparatus of any of claims 13-16, further comprising: aggregating means for aggregating the plurality of usage event data records in the one extended data record based on measures selected from session duration, count of files, count of sessions, count of initial xDRs, data volume (uplink, downlink or total).

18. The apparatus of any of claims 13-17, further comprising: threshold means for setting at least one threshold with respect to at least one counter of the usage event data records, wherein the at least one counter relates to at least one of file count, records count, session count, duration amount, or data volume amount.

19. The apparatus of claim 18, wherein the generating is performed when the at least one threshold is exceeded.

20. The apparatus of claim 18 or 19, further comprising: incrementing means for incrementing the at least one counter based on a newly received usage event data record.

21. The apparatus of any of claims 13-20, further comprising: flagging means for flagging at least one behavior in a network, wherein the generating is performed based on a flag rule violation.

22. The apparatus of claim 21 , wherein the flagging is responsive to at least one of an access network change, an access point name change, a quality of service change, a mobile subscriber integrated services digital network number change, international mobile equipment identity change, or location change.

23. The apparatus of claim 21 or 22, wherein the flag rule violation is based on a combination of a plurality of flags being changed.

24. The apparatus of any of claims 13-23, wherein the generating is performed upon the expiration of a timer.

25. The apparatus of any of claims 13-24, wherein the apparatus comprises a mediation device or a pre-mediation device.

26. A non-transitory computer readable medium encoded with instructions that, when executed in hardware, perform a process, the process comprising the method according to any of claims 1-12.