WO2022173407A1

WO2022173407A1 - A system and method for preventing the network terminated fraud by using real calls

Info

Publication number: WO2022173407A1
Application number: PCT/TR2022/050123
Authority: WO
Inventors: Bulent Koksal
Original assignee: Turkcell Teknoloji Arastirma Ve Gelistirme Anonim Sirketi
Priority date: 2021-02-15
Filing date: 2022-02-15
Publication date: 2022-08-18
Also published as: TR202102074A2

Abstract

The present invention relates to a method and system which uses the calls that the real calls of the real subscribers make towards the real subscriber numbers for preventing the Network Terminated Fraud on a telecommunication ON (10) (Operator Network). In the said invention, a CU (11) (Control Unit) is triggered for the real calls from the FN (22) (Foreign Networks). These real calls are the originating international calls of the real subscribers of the FNs (22) around the word. In the said invention, a CDU (24) (Central Distribution Unit) receives these real calls from the FNs (22) and distributes them to the CUs (11) of the ONs (10). The said CDU (24) provides service to many ONs (10) around the world. The CSNs (Called Subscriber Number) of the real calls are controlled by the CU (11) during the real calls and the CU (11) determines the terminated calls of the real calls. As a type of interconnection fraud and bypass, the Network Terminated Fraud is detected and prevented by analyzing the CNI (Calling Number Information) of this terminated call of the CSN. In the Network Terminated Fraud, the FUs (30) (Fraud Unit) make national calls in order to terminate the international calls to the CSNs of the ON (10). The subscription numbers, for example "SIM Box" numbers, which are exploited by the FUs (30), are detected and blocked. If these subscription numbers belong to the ON (10), then the detected fraud is Network Terminated Fraud Inside the Network; if these subscription numbers belong to the other national networks in the country of the ON (10), then the detected fraud is Network Terminated Fraud Outside the Network.

Description

A SYSTEM AND METHOD FOR PREVENTING THE NETWORK TERMINATED FRAUD BY USING REAL CALLS

Field of the Invention

The present invention relates to a system and method for detecting and preventing the network terminated fraudulent operations on the networks of telecommunication operators, particularly by using the real calls of the real subscribers.

Background of the Invention

International calls between the network operators are carried over legal interconnection routes. The quality of the traffic on these interconnections are controlled by interconnection operators. Operators charge the operators that they interconnect with, in return for the service of terminating the international calls on their networks. Fraudsters obtain the traffic from other carriers instead of using legal interconnections and terminate it to the ON (Operator Network) in a different way with a lower cost. Thereby, fraudsters steal a considerable amount of revenue from operators as a global problem which is common and increasing, and accordingly, governments suffer from losses of tax as well.

According to the scenario of the fraud, international calls are carried to a FU (Fraud Unit), e.g. a “SIM Box” or “GSM Gateway”, of the fraudster located at the target country of the international calls over the Internet. These calls can be carried as VoIP (Voice over Internet Protocol) call, Video over IP call or another type of IP (Internet Protocol) multimedia session. This FU of the fraudster includes subscription access interfaces such as SIM (Subscriber Identity Module) cards of the mobile subscriber numbers of the national operators and might have a fraudulent access such as a PBX (Private Branch Exchange) or SIP (Session Initiation Protocol) Trunk line. The said FU terminates the international calls received to the called subscriber numbers, by making originating national calls over these subscriber access interfaces it exploits. This scenario is called Network Terminated Fraud in the present invention disclosed, however, it is called with different expressions such as Termination Bypass, Bypass Fraud, Bypass of the Interconnects or “SIM Box” Fraud in the prior art.

In the prior art, test calls are generated between the test numbers in order to detect the fraudulent numbers used for bypassing the interconnections. However, due to the presence of unnatural parameters such as calling and called numbers in the signaling of the test calls, fraudsters can recognize these test calls and take precaution. For this reason, these methods have become non-functional in time.

In an another aspect of the prior art, as set forth in the patent application numbered W02012003514A1 and titled “Advanced predictive intelligence for termination bypass detection and prevention” and in the patent application numbered W02017167900A1 and titled “Method and system for detection of interconnect bypass using test calls to real subscribers”, test calls are generated such that real subscribers will make correct calls to the subscriber numbers and the calling number information will also be the real subscriber number. This method served as an effective detection method against the fraudsters to some extent since it makes it difficult for fraudsters to recognize these test calls.

In addition to the abovementioned state of the art, this invention intended to be achieved uses real calls and said real calls are basically the originating international calls of the FNs (Foreign Networks) all over the world. A CU (Control Unit) is triggered for real calls of the FNs. By using techniques for transmitting this triggering of the real calls from the FNs to the CU of the ON, CU controls the CSN (Called Subscriber Number) of the real calls, and detects and prevents the Network Terminated fraud for these real calls. The real calls are first reported to the target operator as triggers before reaching to the ON and thus, the CU detects and prevents the Network Terminated Fraud for all of the international traffics originating from these FNs towards the ON. For this reason, this characteristic makes this method consistent and deterrent against the fraudsters. The use of the real calls provides significant advantages and solves many problems included in the known state of art. The main advantages of the real call method over generating test call can be grouped as follows:

Since it is increasingly costly for the operators to generate test calls from the networks in many parts of the world, this may not be possible in practice.

Suppliers detecting the fraud have a limited capacity of generating these test calls.

Speed is crucial for fraud detection. As a result, test calls sample the real traffic to be able to detect Network Terminated Fraud. For example, even the use of a SIM Box number for a half an hour can cause the fraudsters to survive by including the new numbers into the line. This leaves room for the fraudsters. The real call method allows the operators to detect these numbers as soon as fraudulent activity is performed through these numbers, without the need to wait for a test call to coincide with these numbers.

With the use of real traffic, the real calls do not leave any room for the fraudsters carrying the traffic from the FNs. In addition to this, this real call method can be used within the scope of the triggers that can be obtained from the FNs all around the world.

During a test call which calls a real subscriber number, connecting the terminated calls is not allowed in order to prevent these calls from ringing the subscriber numbers. In the prior art, there is a risk of failure for a normal coinciding call during this test call. This makes the test call method inconvenient for modem customer-oriented networks. In the real call method, there is no risk of failure for any call because the real calls are connected to the CSNs. In the real call method, in the event that the CU cannot respond to the network, there is no intervention of the CU in the ON because the terminated calls are still connected. However, the test calls must be prevented from ringing the called subscriber numbers.

Even if the calling and called subscriber numbers are selected from the real subscriber numbers as in the prior art, there are other parameters of the call carrying protocols on which the fraudsters implement algorithms for separating the test calls and routing the traffic from legal directions. When the real calls are used, such algorithms of the fraudsters based on the Artificial Intelligence and Machine Learning become non-functional.

As a precaution against the techniques that the operators use for detection, some fraudsters terminate the international calls firstly through legal international routes of the operators. After ringing and even answering the calling number, while holding the incoming call, they interrupt the terminated call and make a new call over the FU. As a precaution against such fraudsters, the cost of answering test calls should be tolerated and thus the risk of answering any potential coinciding subscriber calls by accident should be taken. Since the real calls are answered by their CSNs by nature: o There is no cost for answering. o There is no risk of answering for the coinciding subscriber calls. o Alternative routing precautions of the fraudsters fail.

Initially, obtaining the triggers from the FNs can be practically performed by supplying triggers between the international roaming partner networks (IRPNs) for mobile networks and by supplying triggers between mobile and fixed networks of the telecommunication group companies operating in many countries. More importantly, this commercial case has the potential of terminating the inter-connection fraud due to the fact that it offers a win-win opportunity for networks of originating and terminating calls. This is based on the fact that even in the case that even if the network from which the calls are originated does not implement this fraud prevention method on its network mutually with the network that is the target of the calls, when the triggers of the networks are supplied to the target networks, it is ensured that the outgoing international calls are delivered to the target networks over interconnection routes free and clear of the Network Terminated Fraud and in high quality.

Summary of the Invention

The objective of the invention is to provide a method and system for detecting and preventing the “Network Terminated Fraud” operations which globally cause revenue loss for the telecommunication operators, on the networks of the telecommunication operators by using the real calls of the subscribers.

Detailed Description of the Invention

“A System and Method for Preventing the Network Terminated Fraud by Using Real Calls” which is realized for achieving the objective of the present invention is illustrated in the accompanying drawings, wherein:

Figure 1 is a schematic view of the inventive method and the system for preventing the network terminated fraud by using real calls.

Figure 2 is a schematic view of transmitting triggers of the real calls to the CUs without the analysis of the NP (Number Portability) on the inventive method and system for preventing the network terminated fraud by using real calls.

Figure 3 is a schematic view of transmitting triggers of the real calls to the CUs with the analysis of the NP via Pioneer CU on the inventive method and system for preventing the network terminated fraud by using real calls. Figure 4 is a view of transmitting triggers of the real calls to the CUs with the analysis of the NP via a Signaling Relay Function (SRF) on the inventive method and system for preventing the network terminated fraud by using real calls.

Figure 5 is a schematic view of transmitting triggers of the real calls to the CUs with the analysis of the NP via CDU (Central Distribution Unit) on the inventive method and system for preventing the network terminated fraud by using real calls.

The components illustrated in the figures are individually numbered, where the numbers refer to the following: 10: ON (Operator Network).

11 : CU (Control Unit).

12: IN (Interconnection Node).

13: SN (Service Node).

17: Radio Base Station 20: Subscriber Access Interface.

21: SU (Supplier Unit).

22: FN (Foreign Network).

23: Block Chain Network or International Signaling Carriers.

24: CDU (Central Distribution Unit). 25: International Traffic Carriers.

27: Internet. 30: FU (Fraud Unit).

32: NP (Number Portability) Database.

33: Central STF (Signaling Transfer Function).

34: ENUM (E.164 Number to Uniform resource identifier Mapping) Database.

35: HLR (Home Location Register).

In the present invention disclosed, a CU (11) controls the CSNs (Called Subscriber Numbers) of the real calls. The real calls may be triggers that are triggered from the SUs (21). These SUs (21) may be the FNs (22) all over the world, which these FNs (22) triggers the originating international calls to the CU (11) of the ON (10) as triggers. Alternatively, the SUs (21) may be the CUs (11) from the other countries different from the country of the ON (10). These real calls having the subscriber numbers of the ON (10) as CSN are used for detection of the Network Terminated Fraud. The SUs (21) centrally trigger a CDU (24) and this CDU (24) centrally routes these triggers to the CUs (11) of the ONs (10).

Throughout the control of the CSNs, incoming calls of the CSNs are controlled by the CU (11). The CU (11) determines at least one terminated call of this real call. Throughout this control, the terminated call can be determined by means of the triggers of the incoming calls of the CSN. The CU (11) activates a change in the subscription profile of the CSN for a temporary control period so that the ON (10) can trigger the incoming calls of the CSN to the CU (11) as signaling. Alternatively, the terminated call can also be determined through the network CDR (Call Detail Record) for this terminated call.

The CU (11) compares the CNI of the received terminated call with the CNI of the real call. If the CNIs are different and the subscription of the CNI belongs to the ON (10) obtained as a result of the NP query, then the terminated call is detected as Network Terminated On-Network Fraud and this received CNI is detected as Network Terminated On-Network Fraudulent Number. If the subscription of this received CNI is from a different national network in the country of the ON (10), in this case this received CNI is detected as Network Terminated Non-Network Fraud. According to a predefined logic, these detected Fraudulent Numbers can be automatically blocked by the CU (11) for preventing the Network Terminated Fraud.

About triggers related to the real calls of the Supplier Units (SU) (21)

Figure 1 shows the ways that the international calls terminate to the ON (10) after being triggered from the SU (21). In the first normal case, the terminated call of the real call is terminated over the interconnection paths in an IN (12) of the ON (10). In the second fraudulent case, one of the International Traffic Carriers (25) transmits the calls through the internet (27) to an FU (30), and the said FU (30) terminates the calls to their CSNs as Network Terminated Fraud. The FU (30) may use the subscriber numbers known as "SIM Box" for mobile networks and terminates the international call as a mobile origin call via a Radio Base Station (17) of the ON (10). The FU (30) may also use a fixed Subscriber Access Interface (20) such as a PBX or SIP Trunk. Calls are established by an SN (13) of the ON (10) towards their CSNs.

In one embodiment of the present invention disclosed, the SU (21) is the source of triggers of the real calls. For example, when a real subscriber of a FN (22) makes an originating international call, the FN (22) triggers the said real call to the CU (11) of the ON (10) through the International Signaling Carriers (23). Here, the SU (21) is the FNs (22) all around the world and the real calls are the originating international calls of the said FNs (22).

In another embodiment of the present invention disclosed, the SUs (21) are the CU (11) of other countries other than the country of the ON (10). The real calls are the originating international calls of the ON (10) of the CU (11) in said other countries. In other countries, operator networks are configured to trigger all originating international calls to their CUs (11). In this way, operators or service providers providing services for fraud prevention can share triggers between the CUs (11) from different countries according to the mutual agreements between operators and service providers.

The said trigger is a communication related to the call information. The communication comprises sending an initial message or sending an initial message and at least one subsequent message. The initial message of the trigger comprises the call information, and the said call information comprises CSN, CNI, country code of the FN (22) of the real call, the operator code of the FN (22) of the real call, the start timestamp of the start message, or the time zone of the said timestamp. The subsequent message of the trigger comprises the call information, and the said call information comprises at least one or more of the ringing notification of the CSN, answer notification of the real call, or the termination notification of the real call.

In another embodiment of the present invention disclosed, the communication between the SUs (21) and the CUs (11) is performed through a private block chain network. The SUs (21) and the CUs (11) of the ONs (10) are connected to the said private block chain network. The call information is triggered from the SU (21) to the CU (11) according to a smart contract established between the ON (10) of the SU (21) and the ON (10) of the CU (11). This smart contract defines the rules for sharing the call information among the ONs (10). In this way, the block chain technology helps ensuring transparency and certainty of the carried call information such as CSNs and CNIs. The SU (21) triggers the call information of a call to the CU (11), which has the number prefix of the CSN. Within the block chain network, the said call information is protected from the SUs (21) and the CUs (11) of other operators who are not party to the call. In the block chain network, a channel structure is established between the ON (10) of the SU (21) and the ON (10) of the CU (11). This structure allows the SU (21) and the CU (11) of the mutually trusting operators to see the data, but prevents other ONs (10) from seeing the content of the data. Smart contracts and channel structure between the operator networks help fulfilling the regulatory and privacy requirements of the source and destination operator networks. While it is also possible to use an CDU (24) within the block chain network, the decentralized nature of the block chain technology benefits the ONs (10) by eliminating the need to use an CDU (24) and intermediary signaling carriers. As a result, delivering the triggers related to the call information through a block chain network provides a more flexible, more reliable and more cost-effective solution.

In addition to such general communication of the call information, triggers can also be standard communication protocols of telecommunication networks. There are INAP (Intelligent Network Application Protocol) or CAMEL (Customized Applications for Mobile network Enhanced Logic) signaling protocols that can be used in this way to trigger a real call. While the INAP can be used for fixed networks, the CAMEL can be used for mobile networks. In both protocols, the IDP (Initial Detection Point) initial message of the trigger is sent to the SCCP (Signaling Connection and Control Part) GT (Global Title) address of the CU (11), wherein the CU (11) operates as a SCF (Service Control Function). Other successive (consecutive) call information such as ringing, answering and terminating events related to the status of the real call are transmitted to the CU (11) via the protocols during the real call. Triggers based on number series called using the INAP or CAMEL protocols are provided and widely used in the fixed and mobile networks. The SU (21) can configure any called number series to be triggered to be sent to the defined SCCP GT destination address of the CU (11). For example, depending on the country or operator number series of the CU (11), the FN (22) as a SU (21) can configure the said number series to trigger to the CU (11) in trigger configurations of the FN (22).

It is useful to clarify the difference between the number series-based triggers and the CAMEL triggers in international roaming. For example, the FN (22) triggers the originating real calls in their networks based on the called destination country or operator number series. As a result of this, the mobile FNs (22) trigger the international calls of roaming subscribers in their networks as well as the calls of their own subscribers. Meanwhile, since these triggers are independent of which subscriber is calling but depend on the called number series, triggers are independent of the CAMEL signaling communication of international roaming subscribers, and the said the communication is not number series-based triggers and uses the O-CSI (Originating - CAMEL Subscription Information) feature of the protocol. With the convergence of fixed and mobile networks, IMS (IP-Intemet Protocol- Multimedia Subsystem) based networks centrally provide service to different access networks. Accordingly, SIP (Session Initiation Protocol) can be used to trigger NGN (Next Generation Networks) based the FNs (22) as well as the IMS-based FNs (22). INVITE initial message of the trigger is sent to an Application Server Name of the CU (11) which is configured as an Application Service defined in the IMS based the SUs

(21). This Application Service is activated when the real call in the SU (21) calls the subscriber number of an international destination. In addition to defining triggers as an Application Service in IMS networks, any network that supports SIP, such as IMS or NGN networks, can also trigger SIP INVITE messages to a plurality of destinations using flexible number-based routing configurations on access or gateway SBCs (Session Border Controller). This exactly seems like the number series based triggers configured in CS (Circuit Switched) based telecommunications networks that use INAP or CAMEL.

The communication between the SU (21) and the CU (11) of the ON (10) can be performed in two methods. The first one is the direct communication between a SU (21) and CU (11), wherein the SUs (21) use any abovementioned triggering method. In direct communication, the SU (21) must configure all of the target networks to which it will deliver the triggers. As a more practical approach, another method is a central communication in which the SUs (21) trigger the real calls to a CDU (24). And the CDU (24) triggers the real calls to one or more CUs (11) of the ONs (10). Central communication facilitates communication for the SUs (21) and the ONs (10), because the SUs (21) do not have to change their configuration, if they agree with an operator to trigger their originating calls or change the configuration of any target network CU (11). Instead, the CDU (24) can share the triggers between the SUs (21) and the ONs (10) the CU (11) according to the bilateral or unilateral agreements between operators as SUs (21) and other operators as the CUs (11),

Bilateral or mutual agreements provide benefit for both the SU (21) and the ON (10). The FNs (22) make sure that their real calls will be carried over legitimate interconnection paths up to the target ON (10). This is an important motivation for the FN (22) for the quality carriage of their outgoing international calls through legal interconnection routes, for which they pay all costs. Target operator not only prevents Network Terminated Fraud, but also provides better quality for terminated international calls. If both parties trigger each other for their real calls, it provides maximum benefit to both parties.

As for the security and privacy of call information such as CNSs and CNIs, messages of triggers can be encrypted end-to-end and can be performed through Secure International Signaling Carriers (23), VPN (Virtual Private Network) connections or through secure internet (27) connections. Considering the safety regulations of local or regional regulatory agencies, the security and privacy standards of the communication of call information such as the GDPR of European Union (General Data Protection Regulation) can easily be fulfilled.

If the real calls have CSNs comprising the country code of the country of the ON (10), then triggers of the said real calls are transmitted to the ON (10) in the country to which their subscription belongs. These triggers that make calls to local subscriber numbers in a country are used to prevent Network Terminated Fraud. Transmitting the triggers to the ON (10) to which they belong can be achieved by various alternative methods.

As shown in the Figure 2, in one of the methods, either the SU (21) or the CDU (24) triggers the CU (11) of each ON (10) in a country by using multiple triggers. This means that for every new CU (11) that is just starting to serve in a country, the FNs (22) or the CDU (24) will update their trigger settings to trigger this new CU (11). In this triggering method, the CU (11) of each ON (10) in the country receives the triggers of all real calls made to the country. Then, the CU (11) needs to resolve the ON (10) that has the subscription of its CSN by performing a NP (Number Portability) query over an NP Database (32).

In another method, again according to the Figure 2, the SU (21) or the CDU (24) can trigger the CU (11) of each ON (10) only for its own number series of the ON (10). In this case, the CU (11) of the ON (10) do not receive the triggers of the ported in subscriber numbers that are using the original subscriber numbers of other national operators in the country. If the subscription of the CSN of the trigger belongs to the ON (10) according to the NP query made, the CU (11) in the country can implement the fraud prevention method for CSNs that still use the original subscriber numbers of their ON (10).

As a solution to the number portability problem, the ONs (10) that have the subscription of the triggers should be determined by either the SUs (21) or the CDU (24) and transmitted to the ONs (10) having the subscription. Accordingly, in another alternative method, as shown in the Figure 3, triggers are sent to a Pioneer CU (11) of a Pioneer ON (10), which is the ON (10) to implement the CU (11) first in the country. In case a new ON (10) in the country also starts to implement the CU (11) solution as a follower of the said Pioneer CU (11), while the SUs (21) or the CDU (24) trigger the follower CU (11) of this new follower ON (10) only for its own number series, all other number series of the country still continue to be triggered to the Pioneer CU (11). As a solution to the NP problem, the Pioneer CU (11) and the follower CU (11), when they receive the initial messages of the triggers, make NP queries for their CSNs by using the NP Database (32). If they detect an ported out subscription in response to NP queries, the pioneer or follower CU (11) sends these initial messages to the CUs (11) of the ONs (10) having the subscription of the CSNs. In this way, each ON (10) implementing the CU (11) solution is triggered for real calls to its subscribers. As shown in the Figure 4, in another alternative method, a Central STF (33) is proposed to detect the ON (10) having the subscription in the country. Triggers are transmitted to the Central STF (33) in the country by the SUs (21) or the CDU (24). If the ON (10) is implementing the CU (11), the central STF (33) transmits the initial messages of the triggers directly to the CU (11) of the ON (10) having the subscription. The central STF (33) performs NP queries over an NP Database (32) for the CSNs of the triggers to detect the CU (11) of the ONs (10) that have the subscription.

In order to select the appropriate NP solution among the alternatives, the appropriate method can be determined by considering the regulatory needs of the operators. For example, the Central STF (33) may be operated by an operator in a country or by a licensed contractor under the control of the country's regulating agency. Or the regulating agencies may not recommend a Central STF (33) solution, but encourage multiple trigger or the Pioneer ON (10) solutions.

As an alternative solution to the NP problem, the CDU (24) or the SUs (21) can take on the role of triggering the CU (11) as well as determining the ONs (10) that have subscriptions of the triggers. As shown in the Figure 5, if the ON (10) having subscription did not implement the solution of the CU (11), the CDU (24) or the SUs (21) forward the start messages of the triggers to the CUs (11) of the ONs (10) having the subscription. There are alternative methods for detecting the ONs (10) having subscription.

One of the said alternatives is to perform a MAP SRI-SM (Send Routing Information for Short Message) operation to the HLR (35) of the operator that has the number series of its CSN in the country. Depending on the NP practice in the country, this operation gives an answer to the CDU (24) or the SU (21) from either the operator code of the ON (10) having the subscription or HLR (35) of the operator having the subscription. By using configurations of operator codes or SCCP Caller Party Address of the operators, the CDU (24) or the SU (21) determines the ON (10) having the subscription and if CU (11) of the ON (10) is registered in the CDU (24) or the SU (21) to receive triggers, The SU (21) or the CDU (24) sends the initial message of a trigger to the CU (11) of the ON

(10) having the subscription.

In another alternative, as shown in the Figure 5, the CDU (24) carries out NP queries through the NP Database (32) and routes the triggers to the ON (10) having the subscription. A country or an operator in a country may access the said NP database (32).

Besides, as shown in the Figure 5, in another alternative, the CDU (24) routes the triggers to the ONs (10) having the subscription by carrying out an ENUM (E.164 Number to URI Mapping) query to an ENUM Database (34) for the CSN. This query brings the URI (Uniform Resource Identifier) of the ON (10) having the subscription. Although the figures show the CDU (24), the SUs (21) can also determine the ONs (10) having the subscription of their CSNs by using said methods.

For example, in practice, it may not be practical for the FN (22) to trigger or determine the CU (11) of the ON (10) that has subscriptions for many countries and operators. In other words, direct communication between the SUs (21) and the CUs (11) may seem redundant compared to triggering via the CDU (24). However, considering the operators of a telecom group or considering that SU (21) can also be a CU (11) of other countries, it may be a logical and practical option to trigger real calls directly from the SU (21) to the CU (ll).

The CU (11) adaptively processes real calls of the SU (21) depending on the detection of Network Terminated Fraud on the basis of the SU (21). For example, if an FU (30) receives an international call originating from a SU (21), the FU (30) creates a national call to CSN from the ON (10) or another national operator in the country. When the CU

(11) detects the CNI of the said national call as the Network Terminated Fraudulent Number, the CU (11) will adaptively increase the number of triggers that it processes from the SU (21) in which Network Terminated Fraud is detected for this real call. This feature helps the CU (11) to efficiently and quickly detect Network Terminated Fraudulent Numbers.

According to the method, the CU (11) determines the number of real calls in the daily total that should be processed as triggers from the SU (21) and distributes this number into predefined equal time periods of a day. The said distribution is arranged in proportion to the average number of triggers received from the SU (21) in the respective time periods during the same day of the week. For each of these time periods, this distributed value of this total number is divided by the TUQ (Trigger Unit Quota) values in proportion to the number of triggers received from each SU (21). These TUQ values are recorded as pre-defmed TUQs, which are the number of the real calls to be processed from each SU (21) for each time period.

For each new time period and for each SU (21), the CU (11) adaptively determines a new TUQ. If at least one of the real calls was detected as Network Terminated Fraud in this previous time period, the CU (11) adaptively increases the TUQ determined for this previous time period by a predefined rate. Accordingly, the CU (11) adaptively reduces the TUQ determined for this previous time period by a predefined rate, if none of the real calls were detected as Network Terminated Fraud in this previous time period. This TUQ, which is determined adaptively in this time period, can vary between two values determined by a predefined minimum and maximum ratios of the predefined TUQ of the SU (21).

About determining the terminated call of the real call

When the real calls triggered from the SUs (21) reaches the ON (10), the CU (11) determines the terminated call of the real call. In the first embodiment of the present invention, the ON (10) triggers the incoming calls of the CSNs to the CU (11) with signaling. The CU (11) associates the incoming triggers of the incoming calls with the CSN. Then, to determine the correct incoming call among incoming calls as the terminated call of the real call, the CU (11) uses both the call information of the real call and the triggers that it correlates. In the second embodiment of the present invention, the CU (11) uses the correlating network CDRs of its CSN received from the ON (10) as the CDR stream to determine the terminated call of the real call.

In the first embodiment of the present invention, the ON (10) triggers the incoming calls of its CSN to the CU (11) as triggers. The CU (11) determined at least one terminated call by associating the triggers with the CSN. In order to correlate the CSN with the incoming calls, during setup of real calls, the calling party numbers of triggers as correlation parameter are used as association parameter. Normally, the real call is expected to be received as a single terminated call. However, there may be exceptions that result in a plurality of terminated calls associated with the real call. For example, during the control of the CSN, one of the fraudsters could apply alternative routing to break the operators' detection algorithms. In alternative routing, the fraudster first routes the international call through a legitimate interconnection path. After receiving a ring or even an answer from the CSN, they make a second call through the FU (30) while keeping the originating leg of the real call. In this example scenario, being able to detect more than one terminated call makes it possible to detect Network Terminated Fraud during the real call control in all cases.

In determining the terminated call, any potential coinciding calls must be distinguished by the CU (11). Otherwise, for example, if a normal subscriber made a call inside or outside the ON (10), the CNI of a normal subscriber, which coincides with the control period of the CSN, can be detected as a Fraudulent Number. Therefore, if a successive (consecutive) message for said real call signals a ringing, answering, or termination of the real call and if no ringing, answering, or termination notification is received for one or more incoming CSN calls, then one or more incoming calls are detected as coinciding subscriber calls and are not associated with the CSN.

When the CU (11) receives the real call triggered from the SU (21) for a CSN, the said CU (11) makes a change to the subscription profile of its CSN through the subscription interface of the ON (10). This change is applied to the local subscriber numbers, which are the real subscriber numbers of the real subscribers of the ON (10). The change enables the real calls coming to the CSN of the ON (10) to be triggered to the CU (11) as signaling. The parameter change in the profile of the CSN is restored when the control of the CSN is complete.

The control period is temporary. Although it has a pre-configured maximum control time, control of the CSN can also be terminated by the CU (11) before this temporary time. The CU (11) can end control when it detects a Network Terminated Fraud or also if the real call terminates before the maximum control time, or after a predefined number of seconds as of the CSN answering the terminated call.

In an embodiment of the method, the CU (11) is triggered as an App Service with SIP. This change in the subscriber profile is an Application Service definition. The CNI of the incoming call is carried in the Telephony URI parameter in the SIP INVITE message.

In an embodiment of the method, the CU (11) is triggered by the INAP or CAMEL protocols. The change in the subscriber profile is an existing TDP (Trigger Detection Point) definition for terminated calls in INAP. And this change in the subscriber profile is a T-CSI (Terminating Camel Service Information) definition defined in the CAMEL protocol and the HLR (35) of the said CSN. The CNI of the incoming call is carried in the Calling Party Number parameter of the IDP message in the INAP and CAMEL protocols.

It is not mandatory to control the incoming calls to the CSN. This is because real calls should normally connect to their CSNs. As a precaution against any possible operational malfunction in the CU (11) or any communication problem with the CU (11) on the ON (10) side, when ON (10) cannot receive a reply to a trigger from the CU (11), the ON (10) can resume the terminated call. To enable this behavior in a non-mandatory manner, The Default Handling parameter is set in the Application Service profile for SIP and the Default Call Handling parameter is set in the CAMEL or INAP service profile of the CSN.

According to the Figure 1, when the real call enters the ON (10) through an IN (12), in mobile networks, the IN (12) triggers the CSN after receiving a T-CSI parameter from the HLR (35) of the CSN to a MAP SRI (Send Routing Information) operation. The CU (11) receives the initial message of IDP from the IN (12) as trigger and uses the CNI of the trigger for detecting Network Terminated Fraud. In fixed or IMS networks, the real call is routed to the SN (13), which is node of the CSN that provides service. In fixed networks, the SN (13) triggers the real call to the CU (11) due to the TDP setting in the subscription profile of the CSN by using the INAP IDP message. Similarly, on the IMS networks, the IN (12) or specifically an SBC routes the real call to the SN (13) or specifically S-CSCF (Serving-Call Session Control Function) of a CSN through an I- CSCF (Interrogating-Call Session Control Function). S-CSCF providing service for the CSN triggers the CU (11) with a SIP INVITE message as an Application Service of the CSN.

In scenario of the Network Terminated Fraud Outside the Network, the real call is terminated from a different national operator. This time the real call is not received from the International Traffic Carriers (25), but from the national interconnection of the national operator. However, the real call is still received from an IN (12) of the ON (10). However, the CNI of the real call will be a subscriber number of the national operator from which the call is received. This causes the CU (11) to detect its CNI as the Network Terminated Fraudulent Number Outside the Network.

In the scenario of Network Terminated Fraud Inside the Network, the real call is routed to a FU (30) by any carrier among the International Traffic Carriers (25). The FU (30) makes a new call to the CSN. The FU (30) uses a Radio Base Station (17) in mobile networks and an MSC (Mobile Switching Center) triggers the CU (11) as an SN (13). In fixed networks, the FU (30) uses a Subscriber Access Interface (20) and the SN (13) of CSN triggers the CU (11). In IMS base networks, the FU (30) can use mobile or fixed access networks and the real call is transmitted to the S-CSCF by a P-CSCF (Proxy-Call Session Control Function). This S-CSCF also triggers the CU (11) as the SN (13). In such cases, the CNI of real calls will be a subscriber number of the ON (10). Therefore, the CU (11) detects the CNI as the Network Terminated Fraudulent Number Inside the Network.

In the second embodiment of the present invention, the CU (11) uses the CDRs of the ON (10) to determine at least one terminated call of the real call. These correlating network CDRs are obtained from a process of the ON (10). This process is fed from the charging system or signaling monitoring system of the ON (10). The initial timestamp of the real call and the CSN correlation parameters are sent to this process. A time period is used to query the correlating network CDRs of the CSN, since international calls have variable delays until they reach from the FN (22) to the ON (10). For this reason, a predefined time interval starting from the start timestamp is used by said process as a time filter. The process returns a list of correlating network CDRs. Each row in this list contains the parameters of the associated network CDR in columns.

Due to the delay in the operator's CDR infrastructure, the CU (11) can take action after a predefined maximum delay time for terminated calls. Meanwhile, since no real-time action is required during the terminated call, even if it is detected after the expiry of the maximum delay period, delayed Detected Fraudulent Numbers can be prevented even after the timeout of this maximum delay period. Briefly, any delay in the CDR flow will only affect the detection speed.

The associated network CDRs provided are those of the incoming calls of the CSNs during this time interval. At this point, coinciding subscriber calls should be sorted out. Accordingly, if the CU (11) detects an answer or termination event related to the real call and if the timestamps of the corresponding answer or termination event of the associated network CDRs do not coincide within a predefined number of seconds, then the CU (11) detects incoming calls of the associated network CDRs as coinciding subscriber calls and does not associate said associated network CDRs to this CSN. The associated network CDRs are deleted from the list.

After distinguishing between possible coinciding subscriber calls, at least one correlating network CDR is expected to remain in the list. These one or more correlating network CDRs are treated as the CDR of the terminated call, or in other words, the terminated call of the real call. In order to obtain the CNI, calling number information is separated from each correlating network CDR remaining in the list.

Without taking into account that it is detected from the correlating network CDRs or the triggers of the incoming calls, a method is applied to the CNIs of detected coinciding subscriber calls. The said method in the present invention disclosed is called as Repetitive CNIs in Coinciding Calls. If the same CNIs are detected as the CNI of a predefined repetitive number of coinciding subscriber calls, it can be assumed that this CNI is actually used for Network Terminated Fraud. This is because there is a highly negligible probability that a scientifically normal subscriber will make calls to different CSNs that coincide with their control times in the CU (11) of the CNI. Considering any manipulation by fraudsters of the timing of signaling messages, which would be perceived as coinciding subscriber calls, the CU (11) keeps the CNIs of detected coinciding subscriber calls in a CNI list. The CU (11) automatically deletes this CNI after a predefined period from its entry into this CNI list. If a CNI of this CNI list is detected as the CNI of a predefined number of consecutive coinciding subscriber calls, then the CU (11) detects this CNI as a Detected Fraudulent Number. For example, if a fraudster tries to deceive the CU (11) by placing a delay on ringing, answering or termination events, if the CNI of the fraudster is detected as the CNI of a predefined number of coinciding subscriber calls, then it is caught as a Detected Fraudulent Number. This ensures that CNI, which has missed from any detection, is caught in the successive attempts of the fraudsters.

About detecting and preventing the Network Terminated Fraud After detecting one or more terminated calls of the real call, the CU (11) performs a CNI analysis of the terminated call. There may be cases where more than one terminated call is detected, thus the CNI of each terminated call is analyzed in the same method. If the fraudsters use subscriber numbers to which the ON (10) has a subscription in ON (10), the detected fraud is the Network Terminated Fraud Inside the Network and the Detected Fraudulent Numbers are Network Terminated Fraudulent Numbers Inside the Network. In another words, if the CNI of the terminated call of the real call is different from the original CNI of the real call and the subscription of the CNI belongs to ON (10) as a response to a NP query for CNI, it is detected as Network Terminated

Fraudulent Number Inside the Network.

If fraudsters use subscriber numbers that are subscribers of another national network in the country, the detected fraud is the Network Terminated Fraud Outside the Network and the Detected Fraudulent Numbers are Network Terminated Fraudulent Numbers Outside the Network. In another words, if the CNI of the terminated call of the real call is different from the original CNI of the real call and the subscription of the CNI belongs to another national network as a response to a NP query for CNI, it is detected as Network Terminated Fraudulent Number Outside the Network.

The detected Network Terminated Fraudulent Numbers are prevented from Network Terminated Fraud in the ON (10). However, the probability of receiving a coinciding subscriber call corresponding to the CSN during the control of the CU (11) is a significant possibility. For example, although it seems highly unlikely, before a real call reaches to the ON (10), while a call is established between International Traffic Carriers (25); first coinciding subscriber call is terminated, and coincidentally, the real coinciding subscriber call is terminated, thereby they can be simultaneously terminated. In this rare case, the CU (11) fails to distinguish the coinciding subscriber call of the CSN. And the coinciding subscriber call will be detected by the CU (11) as a Network Terminated Fraud and the CNI as a Detected Fraudulent Number. Meanwhile, to clarify the difference between the Repetitive CNIs in Coinciding Calls, the Repetitive CNI method is a prevention against fraudster who change their signaling timings to disguise as a coinciding subscriber call. Therefore, the purpose of Repetitive CNIs is to catch missed fraudulent CNIs in the repeated detection of coinciding subscriber calls. On the other hand, the purpose is to prevent the CNI of a normal subscriber in a coinciding subscriber call from being blocked as a Detected Fraudulent Number by allowing the CNI to be repeatedly regarded as a Detected Fraudulent Number.

Depending on the risk avoidance of an operator, the operator can decide between blocking Detected Fraudulent Numbers in real time and waiting for them to be detected for a predefined period of time. The ON (10) can choose the risk level by setting this predefined number in the CU (11). For example, the operator can set the predefined number to one to block Detected Fraudulent Numbers in real time as soon as they are detected, or set the predefined number to two and wait for the same CNI to be blocked a second time.

According to the method, the CU (11) adds this Detected Fraudulent Number to a list. Each Detected Fraudulent Number in this list is automatically deleted from this list by the CU (11) after a predefined period from its entry into the list. This predefined time starts again if each Detected Fraudulent Number is detected again. If this Detected Fraudulent Number is detected as a configurable number of successive Detected Fraudulent Numbers during the time it is active on this list, then a blocking flag is activated in this list for the Detected Fraudulent Number. When a blocking flag is determined for a Detected Fraudulent Number in the list, the CU (11) automatically starts blocking the Detected Fraudulent Number.

If the ON (10) has a subscription of Detected Fraudulent Number, then CU (11) activates the feature of blocking outgoing and incoming calls for Detected Fraudulent Numbers with active blocking flag in this list via the subscription interface of the ON (10). The operator can have interconnection partners having the subscription to block Network Terminated Fraudulent Numbers Inside the Network. In addition, since the blocking speed is very important for operators in order not to lose income with each passing hour, the operator can block incoming calls from these interconnect partners using Network Terminated Fraudulent Numbers Outside the Network. In order to prevent the detected Terminated Network Fraudulent Numbers Outside the Network, the incoming directional calls received from national interconnection directions are triggered to the CU (11) in the ON (10), If the CNI of the trigger related to one of these incoming calls is in the list as a Detected Fraudulent Number with a blocking flag active, then the CU (11) blocks the incoming call of this trigger.

At this point, this predefined time can be important for keeping a number on the list. For example, when a Detected Fraudulent Number is purchased by a regular subscriber of a national operator within a period of time after the number detected as a fraudulent number, the CU (11) will continue to block calls from the same numbers. However, the CU (11) will not block incoming calls if the Detected Fraudulent Number is deleted from the list after the expiry of the predefined period. Therefore, there should be no problem in terms of legitimate use of their CNI by regular subscribers. Meanwhile, this predefined period should be kept shorter than the time that national operators sell the CNI to a new subscriber after terminating the old subscription in the country. About System Applications

A CU System is configured to implement the methods of the present invention regarding the functions of the CU (11). The CU System receives triggers from the SUs (21) for real calls. Real calls are the originating international calls of the real subscribers all around the world. The CU System controls the CSN of each real call during each real call. The CU System is configured to control the incoming calls of the CSN and determine at least one terminated call of each real call. The CU System detects and prevents Network Terminated Fraud by analyzing the CNI related to at least one terminated call. The CU (11) can be configured as a CU System running the CU (11) software modules on a redundant server hardware or in a cloud environment. In the present invention, the CU System, also called the Local CU System, can communicate with the ON (10) locally located in the country of the operator or within the cloud of the ON (10) In addition to serving only the ON (10) as a Local CU System, regulatory agencies of countries or operators in countries may co-operate and position a Local CU System which serves for local national operators of the country. In this operating model, the Local CU System communicates with the national ON (10). Local CU System is triggered from the SUs (21) for real calls. Controlling the CSNs and preventing the Network Terminated Fraud are performed by the Local CU System which locally provides service to the ON (10) or the ONs (10) of the country.

The SU (21) may alternatively be implemented as a SU System. The SUs (21) are configured to trigger call information of real calls as triggers to the CU System. In a type of system application, the SU (21) can be applied as a source of triggers in existing network systems of the FN (22). The FNs (22) configure their networks to trigger a CDU System or directly the CU (11) of the ONs (10). The FNs (22) are from all over the world and the real calls are the originating international calls of the FNs (22). In another system application, the SUs (21) are CU Systems of countries other than the country of the ON (10). These real calls are the originating international calls of the ON (10) of CU Systems of other countries. The ONs (10) of other countries are configured to trigger all their originating international calls to their own CU Systems.

The CDU (24) can be realized as a CDU System. The CDU System provides a centralized communication between the CU Systems of the SUs (21) and the ONs (10) around the world and receives triggers of real calls from SUs (21) and triggers real calls to the ONs (10) CU Systems.

Similar to the CU System, the CDU (24) can be configured as a CDU System running the CDU (24) software modules on a redundant server hardware or in a cloud environment. One or more redundant CDU Systems may geographically contain triggers of the SUs (21) received from the world. The CU System is configured to receive triggers of real calls from at least one CDU System. Besides operating as a standalone CDU System, the CDU System can also operate as a system together with the CU System. This combined system operates as both CDU System and CU System. For example, if there is only one CU System at the initial stage of worldwide application, the CDU System can interoperate with a CU System as a combined system; CDU System and CU Systems herein operates as software modules working together on the same hardware platform or virtual environment.

The CU System can be a Central CU System which serves for the operators located in a central location in a different country. The central CU System controls their CSNs and provides Network Terminated Fraud prevention service to the ON (10) from different operators and different countries. As in the Local CU System, the Central CU System is triggered from the SU (21) for real calls. Central CU system can receive triggers from the CDU System. Alternatively, for example, if there is only one Central CU System in the first stage of the application, the CDU System can work together with the Central CU System on the same system, so that the Central CDU System and the Central CU System can work together as interactive software modules. The central CU System communicates with the ONs (10) by using the International Signaling Carriers (23), VPN (Virtual Private Network) connections or the secure Internet (27) connection. Functions of the CU System can be divided or distributed into central and local functions. Considering the network security needs of the operators and the efficiency of the total system, the CU System can also be configured as a Central CU System or a Local CU System with one or more operators working together. These operators can be from the same country or from different countries. The Local CU System can be configured to serve only one ON (10) locally, or to serve one or more national ON (10) of the country locally. In addition to this, the Central CU System can be located in a central location to serve one or more Local CU Systems. The Local CU System is configured to control its CSNs, detect and prevent Network Terminated Fraud. The Central CU System can be configured to receive the triggers of the real calls from the CU (11) or the CDU System and route it to the Local CU Systems.

Industrial applicability of the invention

Network Terminated Fraud causes a significant amount of loss of income and tax to telecommunications operators and thus to governments, with an increasing trend around the world. Further, the unsupervised technical infrastructures of fraudster leads to significant service quality problems for the customers. As a result, operators are seeking for consistent, inclusive and deterrent solutions against fraudsters.

Claims

1. A method for preventing the Network Terminated Fraud on a telecommunication ON (10); characterized in that it comprises:

- triggering of the CU (11) for real calls from the SUs (21), the said real calls being the originating international calls of the real subscribers all around the world;

- controlling the CSN (Called Subscriber Number) of each real call by the CU (11) during each real call, the said CU (11) controlling the incoming calls of the CSN and determining at least one terminated call of each real call; and

- detecting and preventing the Network Terminated Fraud by analyzing the CNI (Calling Number Information) related to at least one terminated call.

2. A method according to Claim 1; wherein the call information related to real calls is triggered from the SUs (21) to the CUs (11) as triggers and also characterized in that:

- the said SUs (21) are the FNs (22) all around the world and the real calls are the originating international calls of the FNs (22); or

- the SUs (21) are the CUs (11) of the countries other than the countries of the ON (10), the real calls are the originating international calls of the ONs (10) of the said CUs (11) of different countries, the ONs (10) of different countries are configured such that they trigger all of the originating international calls to their CUs (11).

3. A method according to Claim 2; characterized in that the said SUs (21) trigger the said real calls to at least one CDU (24) and this CDU (24) triggers these real calls to the CUs (11) of the ONs (10).

4. A method according to Claim 2 or 3; wherein the said trigger is a communication related to the said call information and characterized in that in the said trigger also - the said communication is performed between the SUs (21) and the CUs (11) through a special block chain network, the said call information is triggered from the SU (21) to the CU (11) according to a smart contract, and the ON (10) of the said SU (21) and the ON (10) of the CU (11) have agreed on the terms of the smart contract; or

- the said communication comprises sending an initial message or sending an initial message and at least one successive (consecutive) message, the said initial message of the trigger comprises the said call information, the call information comprises the said CSN, CNI, country code of the FN (22) of the said real call, the operator code of the FN (22) of the said real call, the start timestamp of the initial message and/or time zone of this timestamp, the successive (consecutive) message of the trigger comprises the call information, the call information comprises at least one or more of the ringing information of the CSN, the answering notification of the said real call and/or termination notification of the said real call; or

- the said communication is INAP (Intelligent Network Application Protocol) or CAMEL (Customized Applications for Mobile network Enhanced Logic) signaling protocol, an initial message of the trigger is sent to the SCCP (Signaling Connection and Control Part) GT address (Global Title) of the SCF (Service Control Function), the said SCF is the CU (11) or the CDU (24)’ and the initial message is a IDP (Initial Detection Point) message; or

- the said communication is SIP (Session Initiation Protocol), an initial message of the trigger is sent to an Application Server Name of an Application Service, the said Application Server Name is identified to the CU (11) or the CDU (24) and the initial message is INVITE.

5. A method according to Claim 2 or 3; characterized in that in case that the said real calls have CSNs having the country code of the country of the ON (10), the method of transmitting the said triggers comprises that: - the CDU (24) or the SU (21) triggers the real calls to each CU (11) of the ONs (10) in a country by using multiple triggers; or

- the CDU (24) or the SU (21) triggers the real calls to each CU (11) in a country, the CSNs of the real calls are from the number area codes of the ON (10) of each CU (11), each CU (11) cannot receive the triggers related to these real calls of the subscriber numbers whose CSNs are ported in, as a result of the query of NP (Number Portability) for CSN, if the subscription of the CSN belongs to its own ON (10), each CU (11) starts said control of the CSN; or

- the CDU (24) or the SU (21) triggers a Pioneer CU (11) of a Pioneer ON (10) in a country for the said real calls with the CSN having the country code of that country, except for the said real calls with CSN having one of the number area codes of ON (10) of other CU (11) in this country, the other CUs (11) are triggered for the number area codes of their own ONs (10), according to the answers of the NP queries they will make for the CSNs of the triggers they have received, if they detect ported out subscriptions for these CSNs, the said Pioneer CU (11) and the other said CUs (11) transmit the said initial messages related to these triggers to the CUs (11) of the ONs (10) having the subscriptions of these CSNs; or

- the CDU (24) or the SU (21) triggers a Central STF (33) in a country for the said real calls, the Central STF (33) carries out a NP query for the CSNs of the said triggers that it receives, and transmits the said initial messages of the triggers that it receives to the CUs (11) of the ONs (10) having the subscriptions of these CSNs; or

- the CDU (24) or the SU (21) transmits the said triggers to the CUs (11) of the ONs (10) which are the networks of the mobile type belonging to the subscriptions of these CSNs by performing a MAP SRI-SM operation for the CSNs and the responses of the said SRI-SM operations indicate the ONs (10) of the subscriptions of these CSNs in a country; or - the CDU (24) or the SU (21) transmits the said triggers to the CUs (11) of the ONs (10) of the subscriptions of the said CSNs by performing a NP query for the CSN from a NP Database (32) or a country or an operator in this country accesses to the said NP Database (32); or

- the CDU (24) or the SU (21) transmits said triggers to the CUs (11) of the ONs (10) of the subscriptions of the said CSNs by performing an ENUM query and ENUM query enables URI (Uniform Resource Identifier) address related to the ON (10) having the said subscription to be obtained.

6. A method according to Claim 2; wherein the CU (11) adaptively processes the said real calls of the SUs (21) as the detection of Network Terminated Fraud is carried out on the basis of SUs (21) and also characterized in that:

- the CU (11) determines the number of these real calls in the daily total that should be processed as triggers from their SUs (21) and distributes this number into the predefined equal time periods of a day, the said distribution is arranged in proportion to the average number of triggers received from the SUs (21) in the respective time periods during the same day of the week; for each time period, the distributed value of the total number is divided by the TUQ (Trigger Unit Quota) values in proportion to the number of triggers received from each SU (21), the TUQ values are recorded as the predefined TUQs and the said pre-defmed TUQs are the number of the said real calls to be processed from each SU (21) for each time period; and

- for each new time period and for each SU (21), the CU (11) adaptively determines a new TUQ, if at least one of the said real calls in the previous time period is detected as Network Terminated Fraud, the CU (11) adaptively increases the TUQ determined for the previous time period by a predefined rate and if none of the said real calls in the previous time period were detected as Network Terminated Fraud, the CU (11) adaptively reduces the TUQ determined for the previous time period by a predefined rate, the TUQ, which is determined adaptively in the said time period, can vary between two values of the SU (21) determined by a predefined minimum and maximum ratios of the said pre-defmed TUQ.

7. A method according to Claim 1; wherein the ON (10) triggers the incoming calls of the CSNs as triggers to the CU (11), the CU (11) determines at least one terminated call by associating these triggers to the CSN and during the setup of the said real calls, the called subscriber numbers in the said triggers are used as the association parameter to associate with the CSN, and also characterized in that:

- the CU (11) maintains the incoming calls coming through the triggers so that the incoming calls can connect to these CSNs, in case that the control of the triggers of incoming calls is not mandatory in the ON (10) and no response is received from the CU (11) for the said trigger during a predefined timeout in the ON (10), the ON (10) can maintain the incoming call; and

- if a successive (consecutive) message of the real call reports a ringing, answering, or termination of the real call and if no ringing, answering, or termination notification is received for one or more incoming CSN calls, then the said one or more incoming calls are detected as a coinciding subscriber call and connected to the CSN by the CU (11).

8. A method according to Claim 7; wherein the triggers related to the incoming calls are provided to the CU (11) by means of a change made on the subscription profile of the CSN, the change is undone upon completion of the said control of the CSN, the CSN is a Local Subscriber Number that is an active real subscriber number belonging to a real subscriber of the ON (10) and characterized in that in the triggers of the incoming calls:

- the CU (11) is triggered as an Application Service with SIP, this change in the subscriber profile is an App Service definition and the said CNI of the incoming call is carried in the Telephony URI parameter in the SIP INVITE message, the change in the subscriber profile contains a DH (Default Handling) parameter with a value that means non-mandatory;

- the CU (11) is triggered as a SCF with INAP or CAMEL protocols, the said change in the subscriber profile is an existing TDP (Trigger Detection Point) definition for terminated calls in INAP, the said change in the subscriber profile is a

T-CSI (Terminating Camel Service Information) definition in the CAMEL protocol and defined in the HLR (35) of this CSN, the IDP message in INAP and CAMEL protocols carries the said CNI of the incoming call in the Calling Party Number parameter, the change in the subscriber profile comprises a DCH (Default Call Handling) parameter with a value that means non-mandatory.

9. A method according to Claim 1; wherein the said at least one terminated call is determined by using the CDRs (Call Detail Record) of the CSN on the respective network and also characterized in that:

- the associated network CDRs are obtained from a process of the ON (10), the said process is fed from a charging system and signaling monitoring system of the ON

(10), the start timestamp of the real call and the CSN are sent to the said process as association parameters, a pre-defmed time interval starting from the start timestamp is used by the process as a time filter and the said process returns a list of associated network CDRs and each row in the said list comprises the parameters of the associated network CDR in columns;

- if the CU (11) detects an answer or termination event related to the real call and if the timestamps of the corresponding answer or the termination event of the associated network CDRs do not coincide within a predefined number of seconds, then the CU (11) detects incoming calls of the associated network CDRs as coinciding subscriber calls and does not associate the CDRs of the associated network to the CSN, the associated network CDRs are deleted from said list; and - at least one associated network CDR remaining in the list is the associated network CDR of at least one terminated call and calling number information is separated from each associated network CDR remained in the list in order to obtain the CNI.

10. A method according to Claim 7 or 9; characterized in that the detected coinciding subscriber calls of the CU (11) is kept in a CNI list of the CNIs, the CU (11) automatically deletes this CNI after a pre-defmed period from its entry into the CNI list; in case that an CNI of the CNI list is detected as the CNI of a pre-defmed number of successive coinciding subscriber calls, the CU (11) detects the said CNI as Detected Fraudulent Number.

11. A method according to Claim 1; characterized in that the detected Network Terminated Fraud is a Network Terminated Fraud Inside the Network and the detected Fraudulent Numbers are the Network Terminated Fraudulent Numbers Inside the Network, if the CNI of the terminated call of the real call is different from the original CNI of the real call and if the subscription of the CNI belongs to the ON (10) as a result of a NP query for CNI, then the CNI is detected as the Network Terminated Fraud Inside the Network.

12. A system according to Claim 1; characterized in that the detected Network Terminated Fraud is a Network Terminated Fraud Outside the Network and the detected Fraudulent Numbers are the Network Terminated Fraudulent Numbers Outside the Network, if the CNI of the terminated call of the real call is different from the original CNI of the real call and if the subscription of the CNI belongs to a national network different from the ON (10) as a result of a NP query for CNI, then the CNI is detected as the Network Terminated Fraud Outside the Network.

13. A system according to Claim 11 or 12; wherein the detected Network Terminated Fraudulent Numbers prevents the said Network Terminated Fraud and also characterized in that: - the CU (11) adds the Detected Fraudulent Number to a list, each Detected Fraudulent Number in the said list is automatically deleted from this list by the CU (11) after a pre-defmed period from its entry to the list, the pre-defmed period restarts if each Detected Fraudulent Number is detected again; if the Detected Fraudulent Number is detected as a configurable number of successive Detected Fraudulent Numbers during the time it is active on the list, a blocking flag is activated in the list for the Detected Fraudulent Number;

- if the ON (10) has a subscription of Detected Fraudulent Number, the CU (11) activates the feature of blocking outgoing and incoming calls for Detected Fraudulent Numbers with active blocking flag in this list via the subscription interface of the ON (10); and

- the incoming directional calls received from national interconnection directions are triggered to the CU (11) in the ON (10), if the CNI of the triggering one of the incoming calls is found as the Detected Fraudulent Number with the blocking flag active in the list, the CU (11) blocks the incoming call of the trigger.

14. A system for preventing the Network Terminated Fraud on a telecommunication ON (10); characterized by at least one CU system configured to

- receive triggers for real calls that are the international originating calls of the real subscribers around the world, from the SUs (21);

- control the CSN of each real call throughout each real call, control the incoming calls of the CSN and determine at least one terminated call of each real call; and

- detect and prevent Network Terminated Fraud by analyzing the CNI for at least one terminated call.

15. A system according to Claim 14; characterized by the SUs (21) configured to trigger the call information of the real calls to the CU System as triggers and - configured to be the FNs (22) around the word and wherein real calls are the originating international calls of the FNs (22); or

- configured to be SUs (21) which are CU Systems of countries other than the country of the ON (10), wherein the real calls are the originating calls of the ONs (10) of the CU Systems of different countries; and configured to trigger all of the originating calls of the ONs (10) of different countries to their own CU Systems.

16. A system according to Claim 14 or 15; characterized by a CDU (24) configured to provide a central communication between the CU Systems of the SU (21) and the ON (10) around the world and receive the said triggers of real calls from SUs (21) and trigger the real calls to the CU Systems of the ONs (10).