WO2019190438A2

WO2019190438A2 - Ott bypass fraud detection by using call detail record and voice quality analytics

Info

Publication number: WO2019190438A2
Application number: PCT/TR2018/050817
Authority: WO
Inventors: Hacı Hakan KILINÇ
Original assignee: Netaş Telekomüni̇kasyon Anoni̇m Şi̇rketi̇
Priority date: 2017-12-29
Filing date: 2018-12-17
Publication date: 2019-10-03
Also published as: WO2019190438A3

Abstract

Invention relates to fraud detection system and method using enriched CDR (Call Detail Records), voice quality records, big data security analytics and machine learning algorithms for detection of fraud made by use of over-the top (OTT) Bypass method in call traffic outgoing from original operator where call starts.

Description

OTT BYPASS FRAUD DETECTION BY USING CALL DETAIL RECORDS AND

VOICE QUALITY ANALYTICS

The Related Art

Invention relates to fraud detection system and method for detection of fraud made by use of over-the top (OTT) Bypass method in call traffic outgoing from original operator where call starts.

Background of the Invention

According to“Global Fraud Loss Survey” report published by Communications Fraud Control Association in 2015, the telecom fraud loss is 38,1 billion US $. In fact, this figure is much higher when fraud incidents not entering records yet. Fraud type called Interconnect Bypass accounts for 6 billion $ of such loss.

International calls are transferred to clients by operators via legal channels and routes pursuant to agreement by and between countries and operators. Today it is seen that this international route is eliminated that is bypassed. There are different types of bypassing since 80’s. Particularly, GSM Gateway or SIMBox (Subscriber Identity Module) is increasingly seen during last decade. To explain simply, calls initiated from a country are terminated in legal appearance but illegal manner in other countries via SIMBox. An unfair gaining is made by use of infrastructure of operators and tax evasion is committed. After messaging applications such as Whatsapp, Viber, Tango, Skype called OTT got popular for last 5-6 years, route of calls has changed and the process starting with decrease in SMS incomes because of said messaging applications and same process continues with decrease in voice incomes.

In addition to ending illegal calls via SIMBox, illegal ending is added by use of such applications. With this method called OTT Bypass fraud, dramatic decrease in operator incomes has occurred. To explain in detail with an example, All's calling Ay§e by use of Viber applications on both phones is a normal OTT calling. However, when AN living in the UK tries to reach Ay§e in Turkey by a GSM or VoIP call, if the call comes to Ay§e as a Viber call, this is defined as an OTT Bypass fraud.

For that reason, telecom operators lose potential call ending incomes and reputation arising from failure to establish quality call. Customers face not only poor call quality but also high amount of invoice arising from long time taking call establishment as well as delays. Government faces income tax loss and loss arising from operator license tenders. An example for such loss is given in Figure 1 illustrating OTT Bypass scenario.

The operators use TCG (Test Call Generator) platforms and applications to discover such fraud activities in interim connections and discover service quality. There are many commercially available goods in the market. TCG platforms provide call starting points from various networks in various countries. An operator using a TCG platform may generate call in its name from various operators in the world. Such platforms show a bypass in incoming call routes. A worldwide TCG platform is needed to discover whether there is bypass in outgoing calls. Furthermore, it is needed to show it with an example and for that reason, it does not give information on rate of bypass. Those using SIM Box and OTT Bypass methods conducting fraud called Interconnect Bypass are tried to be found out by means of expensive and exhausting applications.

TCG is the solutions to generate income multiplying same incidents on telecom network to find out potential income leakage and compliance with legislations. Both cellular and fixed line telecom operators use test caller generators to measure call start time/duration and verify telecommunication rating for CDR: Call Detail Record.

Some services provided by TCGs are as follows:

• Real time test realization for more than one call and data service, for instance, voice, SMS, MMS, HTTP, mobile TV, video call; content downloading (games, ring tones)

• End to end call detail record (CDR)

• Verification test for new tariffs

• CDR matching agreement

• Call rating verification for Interconnection and retail invoicing

• Legal compliance test

• Network performance tests to verify new network components

In the related art for solution of above mentioned problems, a method called TCG is employed but it is realized in a sample space and does not offer a final solution. Interconnect operators using this method also take measures and carry OTT Bypass Gateways to Amazon Web Services and detection by use of such method becomes more difficult. Although there is no document or application making bypass detection by use of OTT Bypass fraud method in the related art, an application disclosing a similar approach is given below.

Patent application numbered US9002320B2 relates to a system capable to make advanced prediction concerning detection and prevention of bypass and SIM box fraud and a method for it. Said method sends one or more than one test call to local unit from a remote unit. Incoming call to local unit having a subscriber number is transferred to a local number. Thereafter, recognition information of incoming call to local number is analyzed to detect if there is bypass fraud. If fraud is discovered, the detected SIM box use is prevented.

In conclusion, it relates to detect and prevent fraud activities conducted by use of OTT Bypass causing income loss of telecom operators and customer dissatisfaction. In case of use of invention by and cooperation of all operators, fraud can be prevented.

Purpose of the Invention

The invention has been developed with inspiration from existing situation and aims to eliminate the above-mentioned disadvantages.

The invention uses enriched CDR to detect OTT Bypass in outgoing calls from original operator where it starts, big data security analytics and machine learning algorithms. To detect those earning unfair gaining by use of OTT Bypass fraud method, the invention aims at examination of outgoing call of the initial operator rendering service to caller in OTT Bypass scenario illustrated in Figure 1. For that reason, it is targeted to install and use the system and method of the invention at said operator.

CDR records contain many statistical data and value of these parameters varies in flowing data. The first step to detect OTT Bypass is to press the call button and to detect the time difference until ring hearing time, that is, Post Dial Delay (PDD) or Ringing Time. Ringing time is the time between INVITE message sending and receiving 180 Ringing reply in Session Initiation Protocol. This reply is a value varying subject to country, region of call target and/or operator. The first target is to evaluate this time and detect OTT Bypass.

It determines normal time according to targets of call and defines rules in the rules and decision engine to determine the calls exceeding such time. Risk scores are also determined according to time. Other parameters to be considered after the time are voice quality parameters. Parameters such as number and rate of loss of voice packages, variance of delays between packages, average, total and maximum values, loss in voice flow, distributions of packages, MOS values (voice quality estimated for 10-second blocks) will be examined and rules will be set out according to normal call average values.

Above parameters are used to determine anomalies by use of machine learning based algorithms in data processing module (decision tree and change point determination) and OTT Bypass suspicious/risk rates are determined by means of detailed examination of such anomalies. According to operator’s request, warning and notifications are given by alarms and notification module according to rate of suspicion. If V-Gate is used, this notification is sent to attack prevention system and action is taken.

The structural and characteristics features of the invention and all advantages will be understood better in detailed descriptions with the figures given below and with reference to the figures, and therefore, the assessment should be made considering the said figures and detailed explanations.

Brief Description of the Drawings

Figure 1 is flow diagram concerning gaining and loss in an exemplary OTT Bypass scenario of the related art.

Figure 2 is schematic view of the fraud detection system being subject of the invention,

The drawings are not necessarily to be scaled and the details not necessary for understanding the present invention might have been neglected. In addition, the components which are equivalent to great extent or have equivalent functions at least have been assigned the same number.

Description of Part References

10. V-Gate service structure

1 1. Package routing module

12. Call tracking module

13. Attack detection system 14. Attack prevention system

20. Fraud detection system

21. Call management module

22. Pre-processing and enrichment module

23. Enriched data module

24. Profiling module

25. Rule and decision engine

26. Data processing module

27. Notification module

Detailed Description of the Invention

In this detailed description, the preferred embodiments of the invention have been described in a manner not forming any restrictive effect and only for purpose of better understanding of the matter.

Invention relates to fraud detection system (20) and method for detection of fraud made by use of over-the top (OTT) Bypass method in call traffic outgoing from original operator where call starts. Figure 2 shows diagram of system structure. V-Gate service structure (10) has Package routing module (1 1) capturing incoming call packages from certain ports (5060-5061 etc.) and transmitting them. The process starting from receipt of call packages by V-Gate service structure (10) continues with transmission of call status and call quality metrics to instantly fraud determination system (20) by V-Call structure.

Call packages, transmitted by package routing module (1 1), are gathered in call tracking module (12). In addition, call tracking module (12) tracks the status of calls during call times and transfers calls to attack detection system (13) and call management module (21). Said attack detection system (13) is the module wherein rules requiring short time (in maximum 1 day periods) analysis (calls during a given time, calls of a certain number, calls in a certain time, directed calls, international calls, calls of users in a certain group etc.) are defined, incoming calls are matched with specified rules, and calls matching rules defined for ending operations are transmitted to attack prevention system (14). In this line attack prevention system (14) prevents calls transmitted from attack detection system (13) and notification module (27).

On the other hand, calls coming to call management module (21) operating on big data platform of operator are put into a common format as call detail record. Pre-processing and enrichment module (22) conducts pre-processing of data and calls coming from call management module (21) and creates information of country, city and operator where they come on basis of IP address and telephone format of call. Data enriched and normalized with pre-processing are kept in enriched data module (23). Enriched data are categorized and sorted out based on call, user, group, region and other characterizing features in profiling module (24). Rule and decision engine (25) defines analytic rules according to several traffic, content and structural criteria for determination of OTT Bypass and a risk score for such rule by use of sorted out data and voice quality parameters. Fraud and anomalies not determined by rules and decision engine (25) are determined by data processing module (26) by use of behaviour analysis based on sorted out data and rules and decision machine (25) outputs, anomaly detection and fraud machine learning algorithms. Notification module (27) is the component wherein data of which risk score is determined on pre determined limits which are transferred by rule and decision engine (25), suspicious status detected in data processing module (26) are transmitted and which transmits the results, sent to it, to related units in line with the definitions made.

Operation steps of the method for fraud detection system (20) consist of followings:

• Processing call packages from origin operator by package routing module (1 1) and sending them to call tracking module (12),

• Gathering call packages in call tracking module (12) and transfer of them to attack detection system (13) and call management module (21 ),

• Matching coming calls t set out rules by attack detection system (13) where rules to require analysis regarding call are defined, and direction of calls meeting the defined rules and intended to be prevented to attack prevention system (14),

• Conversion of V-Call Flow data coming from call tracking module (12) and call data to come instantly from 3^rd parties into a common format as CDR by call management module (21) which runs on operator’s big data platform, and transmission of them to pre-processing and enrichment module (22), • Creating information of country, city and operator of the call undergoing pre processing at pre-processing and enrichment module (22) based on IP address and telephone format, and recording the enriched call data in enriched data module (23),

• Transfer of data given the final version in enriched data module (23) to profiling module (24) and categorization of them according to call, user, group, region and other characterizing features,

• Definition of rules for determining OTT Bypass by use of data and voice quality parameters categorized by rule and decision engine (25) and definition of risk score for each rule,

• Detection of fraud and anomalies not detected by rules and decision engine (25), by use of machine learning algorithms by data processing module (26) on basis of sorted out data and rules and decision engine (25) outputs,

• transmission of data with detected risk score on pre-determined limit and with detected suspicious status to notification module (27) and directing transmitted results to related units in line with the definitions made therein,

Prevention of calls transmitted via s-Alert structure (10) from attack detection system (13) and notification module (27) attack prevention system (14) with rules automatically set out therein if V-Gate service structure is used.

Claims

1. A fraud detection system (20) for detection of fraud made by use of over-the top (OTT) Bypass method in call traffic outgoing from original operator where call starts characterized by consisting of;

• call management module (21 ) operating on big data platform of operator and bringing incoming calls into common format as incoming calls as call detail record,

• a pre-processing and enrichment module (22) conducting pre-processing of data and calls coming from call management module (21) and creating information of country, city and operator where they come on basis of IP address and telephone format of call.

• an enriched data module (23) wherein data enriched and normalized with pre processing are kept,

• profiling module (24) categorizing enriched data on basis of call, user, group, region and other characterizing features,

• rule and decision engine (25) defining rules for determining OTT Bypass by use of sorted out data and voice quality parameters and defining risk score for each rule,

• data processing module (26) detecting fraud and anomalies not detected by rule and decision engine (25), by use of machine learning algorithms on basis of sorted out data and rules and decision engine (25) outputs,

• notification module (27), wherein data of which risk score is determined on pre determined limits transferred by rule and decision engine (25), suspicious status detected in data processing module (26) are transmitted and transmitting the results, sent to it, to related units in line with the definitions made.

2. A fraud detection system (20) according to claim 1 characterized by comprising;

• package routing module (11 ) capturing and transmitting call packages from certain ports,

• call tracking module (12) gathering transmitted call packages and tracking the status of calls during call times and transferring calls to attack detection system (13) and call management module (21), • said attack detection system (13) wherein rules requiring analysis related to call is defined, controlling matching of incoming calls to set out rules, transmitting calls, meeting rules defined for prevention and ending operations, to attack prevention system (14),

• said attack prevention system (14) preventing calls transmitted from attack detection system (13) and notification module (27).

3. A fraud detection system (20) according to claim 2, characterized by comprising the attack detection system (13) wherein rules; based on taking directed calls of certain time, number and user group and international calls; are defined.

4. A fraud detection system (20) according to claim 1 , wherein said voice quality parameters are number and rate of loss of voice packages, variance, total and maximum values of delays between packages, distribution of loss packages in voice flow and MOS value.

5. A fraud detection method for detection of fraud made by use of over-the top (OTT) Bypass method in call traffic outgoing from original operator where call starts characterized by comprising steps of;

• conversion of incoming calls into a common format as call detail record by call management module (21 ), which runs on operator’s big data platform, and transmission of them to pre-processing and enrichment module (22),

• creating information of country, city and operator of the call undergoing pre processing at pre-processing and enrichment module (22) based on IP address and telephone format, and recording the enriched call data in enriched data module (23),

• detection of fraud and anomalies not detected by rules and decision engine (25), by use of machine learning algorithms by data processing module (26) on basis of sorted out data and rules and decision engine (25) outputs, • transmission of data with detected risk score on pre-determined limit and with detected suspicious status to notification module (27) and directing transmitted results to related units in line with the definitions made therein.

6. A fraud detection method according to claim 5 and characterized by further comprising steps of;

• matching coming calls to set out rules by attack detection system (13) where rules to require analysis regarding call are defined, and directing calls, which meets the defined rules and intended to be prevented, to attack prevention system (14),

• prevention of calls transmitted from attack detection system (13) and notification module (27) by attack prevention system (14).