WO2022173410A2

WO2022173410A2 - A method and system for preventing interconnection fraud

Info

Publication number: WO2022173410A2
Application number: PCT/TR2022/050126
Authority: WO
Inventors: Bulent Koksal
Original assignee: Turkcell Teknoloji Arastirma Ve Gelistirme Anonim Sirketi
Priority date: 2021-02-15
Filing date: 2022-02-15
Publication date: 2022-08-18
Also published as: WO2022173410A3; TR202102077A2

Abstract

The present invention relates to a method and a system for preventing interconnection fraud in a telecommunication ON (10) (Operator Network); the said method and system use the real calls of the real subscribers and the calls that are made by the test calls to the real subscriber numbers. In the present invention, the CSNs (Called Subscriber Number) of the real or test calls are controlled by a CU (11) (Control Unit). The CNI (Calling Number Information) Fraud from International Interconnection, CNI Fraud form National Interconnection, Network Originated Fraud, Network Terminated Fraud is detected and prevented by analyzing the IRSCs (Inbound Route Source Code) related to the terminated calls of the CSNs. In the CNI Fraud from International Interconnection, the fraudsters manipulate the calling number information or calling party numbers and terminate the international calls with a lower termination fee. In the CNI Fraud from National Interconnection, the fraudsters terminate the international calls via national interconnection routes. In the Network Originated Fraud, the FUs (30) (Fraud Unit) make originating international calls from the ON (10) to the international foreign numbers, wherein these calls exploit long-distance calling tariffs of the ONs (10). These FUs (30) carry transit international calls as the outgoing international calls from the ON (10). In the Network Terminated Fraud, these FUs (30) make originating national calls to the subscribers of the ON (10) to terminate the international calls. In the Network Originated Fraud and Network Terminated Fraud, the subscription numbers such as "SIM Box" which are exploited by the FUs (30) are blocked.

Description

A METHOD AND SYSTEM FOR PREVENTING INTERCONNECTION

FRAUD

Technical Field

The present invention relates to a method and system for preventing interconnection fraud in the networks of telecommunication operators by analyzing particularly the IRSCs (Inbound Route Source Code) of the terminated calls therefor.

Background of the Invention

International calls between the network operators are carried over legal interconnection routes. The quality of the traffic on these interconnections is controlled by interconnection operators. The operators charge the operators that they interconnect with, in return for the service of terminating the international calls on their network. Fraudsters obtain the traffic from other carriers instead of using legal interconnections and terminate it to the ON (Operator Network) in a different way with a lower cost. Thereby, fraudsters steal a considerable amount of revenue from the operators as a global problem that is common and increasing, and due to this, governments suffer from losses of tax.

According to a fraud scenario included in the prior art: international calls are carried over the internet to a FU (Fraud Unit) of fraudsters, located generally at the target country of the international calls, for example such as a “SIM Box” or “GSM Gateway”. These calls can be carried as VoIP (Voice over Internet Protocol) call, Video over IP call, or any other type of IP (Internet Protocol) multimedia session. This FU of the fraudster comprises subscription access interfaces such as SIM (Subscriber Identity Module) cards of the mobile subscriber numbers of the national operators and it may have manipulative access such as a PBX (Private Branch Exchange) or SIP (Session Initiation Protocol) Trunk line. The FU terminates the international calls received to the called subscriber numbers, by making originating national calls over these subscriber access interfaces it exploits. This scenario is called as Network Terminated Fraud in the present invention; however, in the prior art, it is called with different expressions such as Termination Bypass, Bypass Fraud, Bypass of the Interconnections or “SIM Box” Fraud.

In the prior art, the test calls are generated amongst test numbers to detect the fraud numbers used in bypassing the interconnections. However, due to unnatural parameters such as calling and called numbers in the signaling of the test calls, fraudsters can distinguish the test calls and take precautions against them. Therefore, these methods prove to be useless over time.

In another approach included in the prior art as set forth in the patent application numbered W02012003514A1 and titled “Advanced predictive intelligence for termination bypass detection and prevention” and in the patent application numbered W02017167900A1 and titled “Method and system for detection of interconnect bypass using the test calls to real subscribers”; test calls are generated such that they make calls to the subscriber numbers of real subscribers and the calling number information is the real subscriber number. This method makes it difficult for a fraudster to distinguish these test calls so that it proves to be an effective detection method against fraudsters. This prior art method uses primarily the methods for generating the test calls and then it terminates these test calls in the ON where the solution is offered. Finally, this method detects the Network Terminated Fraud, if the received CNI (Caller Number Information) is different from the CNI of the generated test call and received CNI is within the numbering plan of the country. In this method; a system generates, controls, and terminates test calls.

The method included in the prior art can provide a solution for Network Terminated Fraud. The present invention which is envisaged to be improved solves some problems of the Network Terminated Fraud in the prior art, in addition to providing a solution to a new type of interconnection fraud. The present invention, which is envisaged to be improved, provides solutions for a new type of interconnection fraud using the methods and the systems provided in the invention such as CNI Fraud from International Interconnection, CNI Fraud from National Interconnection, and Network Originated Fraud In the CNI Fraud from International Interconnection, international calls are terminated through normal international interconnection routes. However, CNIs of calls are distorted or manipulated by a fraudster carrier which is in between or in the end to pay a lower interconnection fee than the actual fee charged to the originating country according to the received CNIs. For example, the European Union regulations charge higher interconnection fees for traffic coming from outside the Union. Fraudsters make these calls appear as if they were originated from a member country by manipulating or distorting the CNIs of the international calls into the CNIs of the member countries.

In the CNI Fraud from National Interconnection, the international calls are terminated through the national interconnection routes of the operators instead of using international interconnection routes. Since fraudsters can manipulate the CNIs of these calls into national CNIs, it becomes impossible for the operators to prevent this interconnection fraud by controlling whether these calls are received from national routes with the international CNIs. This type of interconnection fraud is particularly a problem for the countries where the regulations charge a higher termination fee for the international calls than for the national calls, wherein this is a common practice in many countries around the world.

For the Network Originated Fraud, fraudsters carry international calls to a “SIM Box” for example in country A, or to a fixed-line subscriber access interface via the internet. And they make the originated international calls to the subscriber numbers of other countries, for example, country B from these “SIM Box” numbers. The scenario of the Network Terminated Fraud is to terminate international calls to the subscriber numbers of the operator in country A, by making national calls originated from “SIM Boxes”. As for the Network Originated Fraud, the fraudsters exploit the international call tariffs and campaigns which are resulted from the competition between telecommunication operators and OTT (Over-The-Top) service providers. For example, assume that in country A, a fixed-rated calling tariff of an operator includes the service of calling to country B in addition to other countries in the campaign, wherein country B has a higher termination fee, thus it is attractive for the fraudsters. Then the fraudsters exploit “SIM Boxes” in country A, instead of engaging “SIM Box” activity in country B, wherein the fraudsters subscribe to this fixedrated tariff in country A, exploit it, and make originated international calls predominantly to country B. The said international calls causes higher cost for the operator in country A, due to the high cost of carrying outgoing international calls to countries such as country B. In this way, the fraudsters leave the cost burden to the operator in country A, while exposing customers in both countries to distorted call quality.

In the current technique, the Network Terminated Fraud is detected by comparing the received CNI with the original CNI of the generated test call. In the present invention - which is envisaged to be improved- instead of analyzing the CNI, the IRSC (Inbound Route Source Code) values related to the terminated calls of the CSN (Called Subscriber Number) to detect and prevent interconnection fraud. The IRSC value of a terminated call consists of three information: The interconnection partner that sends the terminated call to the ON, the type of routes such as the international route where this terminated call is received, and the operator that has the subscription of the CNI of this terminated call.

The first main requirement of using the IRSC analysis is to detect and prevent two different types of CNI (Caller Number Information) Fraud. In the present invention - which is envisaged to be improved- there is a CU (Control Unit) that processes the triggers, generates test calls, and detects and prevents interconnection fraud. In the CNI Fraud, the CU needs the inbound route information in which the terminated call enters the ON. The said Inbound Route Information gives the CU the IRSC information, which is the interconnection partner to which the inbound route belongs and the type of the interconnection route.

The second main requirement of using the IRSC analysis is to be able to prevent interconnection fraud without faulty detection. In the prior art, comparing the CNIs and controlling whether their numbering plans are included in the national numbering plan of the country lead to faulty detections. The manipulative carriers manipulate the CNIs by changing the CNIs into the normal subscriber numbers of a national operator in the country and this leads the operator to detect said numbers as Fraud Number, thus a faulty detection occurs.

In the mobile networks, the international terminated calls can be triggered to the CSNs in the INs (Interconnection Node). The reason for this is that, in the answer to the MAP (Mobile Application Part) SRI (Send Routing Information) message, the HLR (Home Location Register) of the CSN sends trigger parameters to the IN for triggering the terminated services of the CSN. However, in the non-mobile networks, the calls are normally entered from the INs and reach the SN (Service Node) of the CSN and after that, these calls are triggered to the terminated services of the CSN. These non-mobile networks correspond to fixed networks such as NGN (Next-Generation Networks) or PSTN (Public Switched Telephone Network) and IMS (Internet Protocol Multimedia Subsystem) networks. IMS base networks essentially provide service both to mobile and non-mobile access services and they are envisaged to replace old CS (Circuit Switched) base networks of the modern telecommunication networks over time. Therefore, it is important to solve the said faulty detection problem in non-mobile networks.

In the prior art, the control system in the mobile network detects the Network Originated Fraud Inside the Network if the terminated call is triggered from a MSC (Mobile Switching Centre) of the ON or if a different CNI is received. However, if the call is triggered from an IN, then it is decided based on the different CNI received. In the non-mobile networks, the said terminated call can be an ON originated call or it can reach the ON via the legitimate interconnection route, can be transmitted from an IN to SN, and then be triggered from SN to the control system. This situation is basically the difference in the transmission of the terminated calls between mobile and non-mobile base networks. In the prior art, the control system decides the Network Terminated Fraud according to the received CNI without the Inbound Route Information.

Firstly, there is a faulty detection problem in the non-mobile networks in the prior art. For example, if the fraudsters assign the CNI to a subscriber number of the ON, then the prior art detects the CNI as Network Terminated Fraud Inside the Network in the non- mobile networks. In practice, the operator needs to analyze the CDRs of the terminated call, before blocking the detected subscriber number to make sure that this call is an ON originated call. In another case, the fraudsters can assign the CNI to a CNI which belongs to another operator in the country. Again, the operator needs to make sure whether this call is actually received from an interconnection partner having the CNI by inspecting the CDRs and then can take an action on the CNI. Secondly, there is another unresolved scenario of the prior art. This is applied both to mobile and non-mobile networks. Besides the additional CDR processing effort, if the interconnection partner of the terminated call is a transit carrier and if the CNI assigned by the fraudster belongs to another national operator instead of the interconnection partner, then the operators cannot decide on the CNI even if they process the CDR. This is another problem of the prior art. The present invention which is envisaged to be improved solves this problem by detecting this kind of manipulative calls from National Interconnection as CNI Fraud and preventing thereof.

Accordingly, a reason for the fraudsters to use national CNIs is to terminate the international calls via cheaper national interconnection routes rather than more expensive international routes by using an apparent international CNI without being detected. This kind of fraud is called as CNI Fraud from National Interconnection. The present invention, which is envisaged to be improved, detects a CNI as Network Terminated Fraud Number Inside the Network if the terminated call is received in the CU with an IRSC that notifies an ON originated call. The present invention, which is envisaged to be improved, detects a CNI as Network Terminated Fraud Number Outside the Network if the terminated call is received in the CU with an IRSC that notifies a national interconnection route and the operator having the subscription of the received CNI is the same with the interconnection partner in which the call is received. If the subscription of the CNI belongs to another national operator or does not belong to any national operator, then the said terminated call is treated as CNI Fraud from National Interconnection. The ON can block the calls of CNI Fraud or report it to the interconnection partners. Thus, the analysis of the IRSC allows for eliminating faulty detection of the Network Terminated Fraud Inside the Network and Network Terminated Fraud Outside the Network for the non-mobile networks of the ON. In addition, it solves the problem of detecting Network Terminated Fraud Outside the Network for the mobile and non-mobile networks by detecting and preventing the CNI Fraud from National Interconnection.

Another problem in the prior art is the failure of coinciding calls of the CSNs throughout the control of the test calls which are made to the called subscriber numbers. In addition, there is a risk of answering the coinciding calls by the system generating the test call instead of CSN. This problem is another prior art problem, particularly for the operator networks in which the customer experience is as important as the loss of revenue due to interconnection fraud. The present invention, which is envisaged to be improved, solves most of these drawbacks by distinguishing coinciding subscriber calls from terminated calls of the CSNs and connecting them to the CSNs. While there is still a remaining probability for the failure of the coinciding calls, this probability is considerably reduced compared to the prior art.

Due to the operators increasingly searching for methods to prevent Network Terminated Frauds, some fraudsters primarily terminate the international calls through legitimate international routes of the operators. After the CSN rings or even is answered, they terminate the terminated part of the call, hold the originating part of the call, and reconnect this call as a manipulative call at the same time. The present invention, which is envisaged to be improved, performs real-time analysis of the IRSC of the terminated call during the control of the CSN, reduces the risk of answering a coinciding call coming from the interconnection, and adaptively answers the terminated calls of the test calls. The said feature of adaptively answering focuses the answers of the CU on the terminated calls which are likely to be alternative routing such that the cost of answering the terminated calls is reduced. Thus the present invention, which is envisaged to be improved, provides a solution to an important problem of the prior art wherein fraudsters make a precaution for alternative routing.

In the present invention, which is envisaged to be improved, the real calls and test calls are used together to increase the efficiency in the prevention of interconnection fraud. The real calls are the originating international calls of FNs (Foreign Network) all over the world. The CU controls the CSNs of the real calls by using methods for transmitting the triggers of the real calls from the FNs to the CU of the ON, as well as detecting and preventing interconnection fraud for the real calls. Using real calls provides important advantages and solves many problems of the test call method. In addition, it would be still advantageous to use test calls together with the real calls, since obtaining the triggers of the real calls from the FNs all over the world requires much time for the operators to make agreements with the other operators. This is particularly required for the FNs, from which the operator has not yet obtained the triggers of the real calls.

The method of real call has some advantages over generating the test calls as follows:

- It may not be possible in practice to generate the test calls from the networks in many places of the world since this means an increased cost for operators.

- The suppliers that detect the fraud have limited capacity to generate test calls.

- Speed is an important factor in the detection of fraud. Eventually, the test calls samples real traffic to detect Network Terminated Fraud in the prior art. For example, the use of a “SIM Box” number even for half an hour can cause the fraudsters to survive by including the new numbers into the line. This leaves room for the fraudsters to survive. The method of real call enables the operator to detect these numbers as soon as a fraud activity over these numbers is performed without having to wait for a test call to coincide with these numbers.

- The real traffic coming from the FNs leaves no room for the fraudsters by means of using real traffic. In addition, the real call method can be used within the scope of the triggers obtained from the FNs all over the world.

- Even if the calling and called subscriber numbers are selected from the real subscriber numbers as in the prior art, the fraudsters have other parameters of the call carrying protocols on which algorithms are implemented to distinguish the test calls and route the traffic in legal routes. This becomes even easier for the fraudsters in the protocols such as SIP (Session Initiation Protocol). Such Artificial Intelligence or Machine Learning based algorithms of the fraudsters become disabled when real calls are used.

- The terminated calls are not allowed to be connected for preventing the said calls from ringing the subscriber numbers during the test call that makes a call to a real subscriber number. Any coinciding call during the test call has a risk of failure in the prior art. This makes the test call method impractical for the customer-focused modem networks. In the case of the real call method, there is no risk of failure of the call due to the real calls normally connecting to the CSNs.

- Since the real calls are answered by the CSNs due to their nature: o There is no risk for the coinciding subscriber calls to be answered o Therefore, the alternative routing precautions of fraudsters fail o There is no cost for answering the test calls.

- Detection of the CNI Fraud from International Interconnection and CNI Fraud from National Interconnection by using the test calls provides the operator with evidence to force the interconnection partners and previous carriers into a solution. Despite that, this still does not provide a whole and deterrent solution against the fraudsters. However, if the real calls of the FNs are triggered to the CU, then the CU automatically blocks the terminated call which is detected as CNI Fraud in the ON. This leads to preventing manipulative traffic for the triggered real calls and the fraudsters losing traffic due to failed calls to the ON.

In the initial phase of the worldwide implementation, obtaining triggers from FNs is practically realized by providing triggers between international common roaming networks for mobile networks, or by providing triggers between mobile and fixed networks of telecommunication group companies engaging in business in many countries. More importantly, due to this business case offering a win-win opportunity for networks in which the calls are originated and terminated; it has the potential to end the interconnection fraud. This is based on the fact that even if the network in which the calls are originated does not implement the said fraud prevention method on its network mutually with the network that is the target of the calls when the triggers of the networks are provided to the target networks, it is ensured that outgoing international calls are delivered to the target networks via interconnection routes free and clear of the interconnection fraud and in high quality.

Summary of the Invention The objective of the invention is to realize a method and system that detects and prevents interconnection fraud which causes a high loss of revenue for telecommunication operators by analyzing the IRSC (Inbound Route Source Code) of the terminated calls.

Detailed Description of Invention “A Method and System for Preventing Interconnection Fraud” realized for achieving the objective of the present invention is illustrated in the accompanying drawings, wherein: Fig. 1 is a schematic view of the inventive method and system for preventing interconnection fraud.

Fig. 2 is a schematic view of the inventive method and system for preventing interconnection fraud, wherein the triggers of the real calls are transmitted to the CUs without the NP (Number Portability) analysis.

Fig. 3 is a schematic view of the inventive method and system for preventing interconnection fraud, wherein the triggers of the real calls are transmitted to the CUs by NP analysis via a Leading CU.

Fig. 4 is a schematic view of the inventive method and system for preventing interconnection fraud, wherein the triggers of the real calls are transmitted to the CUs by NP Analysis via a Central STF (Signaling Transfer Function).

Fig. 5 is a schematic view of the inventive method and system for preventing interconnection fraud, wherein the triggers of the real calls are transmitted to the CUs by NP analysis via a CDU (Central Distribution Unit). Fig. 6 is a schematic view of the inventive method and system for preventing interconnection fraud, wherein the test calls which make a call to the local subscriber numbers and roaming subscriber numbers are generated.

Fig. 7 is a schematic view of the inventive method and system for preventing interconnection fraud, wherein the interconnection fraud in the mobile networks is prevented.

Fig. 8 is a schematic view of the inventive method and system for preventing interconnection fraud, wherein the interconnection fraud in the fixed networks is prevented. Fig. 9 is a schematic view of the inventive method and system for preventing interconnection fraud, wherein the interconnection fraud in the IMS networks is prevented.

Fig. 10 is a flow chart of the inventive method and system for preventing interconnection fraud, wherein the interconnection fraud is detected by IRSC analysis of the CSN.

The components illustrated in the figures are individually numbered, where the numbers refer to the following:

10: ON (Operator Network)

11 : CU (Control Unit).

12: IN (Interconnection Node).

13: SN (Service Node). 17: Radio Base Station.

20: Subscriber Access Interface.

21: SU (Supplier Unit).

22: FN (Foreign Network).

23: Block Chain Network or International Signaling Carriers 24: CDU (Central Distribution Unit).

25: International Traffic Carriers.

27: Internet. 30: FU (Fraud Unit).

31: TCGS (Test Call Generation System)

32: NP (Number Portability) Database.

33: Central STF (Signaling Transfer Function). 34: ENUM (E. 164 Number to Uniform resource identifier Mapping) Database.

35: HLR (Home Location Register).

36: IRPN (International Roaming Partner Network)

40: Selected Carrier 41: Subsequent Carrier 42: User Device

43: HSS (Home Subscriber Server)

44: P-CSCF (Proxy-Call Session Control Function)

45: 1-CSCF (Interrogating-Call Session Control Function) In the present invention disclosed, a CU (11) controls the CSNs (Called Subscriber Number) of the source calls. These source calls are triggered from the SUs (21) as triggers or generated by the CU (11) as test calls. The SUs (21) may be the FNs (22) all over the world and the said FNs (22) trigger originating international calls as triggers to the CU (11) of the ON (10). Alternatively, the SUs (21) may be the CUs (11) of the countries other than the country of the ON (10), or the SUs (21) may be any TCGS (31) that makes a call to the international foreign numbers other than the subscriber numbers of the ON (10). The source calls that have the subscriber numbers of the ON (10) as the CSNs are used for detecting the CNI Fraud and Network Terminated Fraud. The source calls that have the international foreign numbers as the CSNs are used for basically detecting the Network Originated Fraud. The triggers of the SUs (21) are collected in a CDU (24) and the said CDU (24) triggers the CUs (11) of the ONs (10) centrally. Alternatively, the SUs (21) may trigger the CUs (11) directly.

In another embodiment of the present invention disclosed, the CU (11) generates source calls as the test calls. The CU (11) may generate the test calls by means of the TCGSs (31), as well as directly using signaling and carrier protocols. The test calls that make a call to the subscriber numbers of the ON (10) are used for detecting the CNI Fraud and the Network Terminated Fraud. The test calls that make a call to the subscriber numbers of the actively visiting international roaming subscribers are used for detecting Network Originated Fraud.

In the Fig. 1, the routes are shown, in which international calls are terminated in the ON (10) after being triggered from a SU (21) or generated as a test call from a FN (22). The SUs (21) or the FNs (22) transmit the international calls to the International Traffic Carriers (25). In the normal first case, the terminated calls are terminated by International Traffic Carriers (25) over the interconnection routes in an IN (12) of the ON (10). The terminated calls can be detected as CNI Fraud or normally terminated calls. In the second alternative, a carrier from the International Traffic Carriers (25) transmits the said calls to the FU (30) via the internet (27), wherein the said FU (30) terminates the calls to the CSN as Network Terminated Fraud or Network Originated Fraud.

The terminated calls of the CSNs are controlled by the CU (11) throughout the control of the CSNs. The CU (11) determines the IRSCs (Inbound Route Source Code) of the terminated calls and matches them with the CSNs throughout the control of the CSNs. In an embodiment of the present invention, the IRSCs are obtained over the triggers of the terminated calls received from the ON (10) throughout the control. The CU (11) controls the terminated calls of the CSN through the said triggers. In another embodiment of the present invention, the IRSCs are determined by the associated network CDRs of the terminated calls that are received as CDR (Call Detail Record) flows from the ON (10). Therefore, the CU (11) controls the terminated calls of the CSN through associated network CDRs of the ON (10). If the terminated call is received from an internal originating route of the ON (10) and if the CSN of the source call is a subscriber number of the ON (10), the said terminated call is detected as Network Terminated Fraud Inside the Network, whereas the CNI of the terminated call is detected as Network Terminated Fraud Number Inside the Network. If the terminated call is received from a national interconnection route of the ON (10) and if the subscription of the CNI of the terminated call belongs to the interconnection partner from which the call is received, then the said terminated call is detected as Network Terminated Fraud Outside the Network, whereas the CNI of the terminated call is detected as Network Terminated Fraud Number Outside the Network. If the terminated call is received from a national interconnection route of the ON (10) and if the subscription of the CNI of the terminated call does not belong to the interconnection partner from which the call is received, then it is detected as CNI Fraud from National Interconnection. If the terminated call is received from an international interconnection route of the ON (10) but if the source call is received with a CNI that indicates a lower interconnection fee than the original CNI, then it is detected as CNI Fraud from International Interconnection. If the terminated call is received from an internal originating route of the ON (10) and if the CSN of the source call is an international foreign number, then it is detected as Network Originated Fraud, whereas the CNI of the terminated call is detected as Network Originated Fraud Number.

The Detected Fraud Numbers are automatically blocked by the CU (11) to prevent real- time interconnection fraud. The terminated calls which are detected as CNI Fraud by using the test calls are challenging for the interconnection partners to fix the traffic routing with the previous carriers. In addition, the CU (11) can block the real calls which are detected as CNI Fraud in real-time, and therefore a more deterrent and complete solution is obtained against the fraudsters.

About the triggering related to the source calls of Supplier Units (21)

The CU (11) uses the concept of the source calls, wherein the source calls may be the real calls from real subscribers or the test calls that make a call to the real subscriber numbers. In an embodiment of the present invention, the SU (21) is the source of the triggers of the real calls. For example, when a real subscriber of a FN (22) makes an originating international call, the FN (22) triggers the real call to the CU (11) of the ON

(10). Herein, the SUs (21) are FNs (22) all over the world and the real calls are the real calls which are the originating international calls of FNs (22).

In another embodiment of the present invention, the SUs (21) are the CUs (11) of the countries other than the country of the ON (10). The source calls are the real calls which are the ONs (10) originated international calls of the CU (11) of other countries. The networks of the operators of other countries are configured such that they trigger all originating international calls to their CUs (11). In this way, operators and service providers offering services to prevent fraud may share triggers between the CUs (11) from different countries according to agreements between operators and service providers. The source calls obtained from the CUs (11) of other countries may comprise all source calls of the CUs (11), which source calls include not only real calls but also the test calls generated by the CUs (11) of other countries. Even if most of the test calls generated by the CUs (11) of other countries make calls to their international foreign numbers, the collection of the triggers of the test calls can be used for detecting the Network Originated Fraud in the CU (11).

The source calls are not limited by real calls of FNs (22) or the test calls of other CUs

(11). The source calls may be triggered from any third-party service, network, or TCGS (31), which TCGS (31) may generate the test calls for a purpose other than fraud prevention. The CU (11) in the ON (10) may use the call information of the test calls for detecting interconnection fraud. For example, the SUs (21) may be any TCGS (31), which TCGS (31) generates the test calls from the FNs (22) all over the world to real subscriber numbers of the other countries. The TCGS (31) generates test calls using test probes, robots, or calling services from all over the world.

This trigger between the SU (21) and the CU (11) is a communication related to the call information. This communication comprises sending an initial message or sending an initial message and at least one sequential (consecutive) message. The initial message of the trigger comprises the call information, which call information comprises the CSN, CNI, country code of the FN (22) of the real call, operator code of the FN (22) of the real call, the initiation timestamp of the initial message and time zone of the time stamp. Sequential (consecutive) message of the trigger comprises the call information, which call information comprises at least one or more ring notifications of the CSN, answering notifications of the source call, or termination notifications of the source call.

In addition to general communication of the call information, the triggers may be also standardized communication protocols of the telecommunication networks. There are INAP (Intelligent Network Application Protocol) or CAMEL (Customized Applications for Mobile network Enhanced Logic) signaling protocols that can be used in this way to trigger a source call. While INAP may be used for fixed networks, CAMEL may be used for mobile networks. In both protocols, IDP (Initial Detection Point) initial message of the trigger is sent to SCCP (Signaling Connection and Control Part) GT (Global Title) address of the CU (11), wherein the CU (11) operates as a SCF (Service Control Function). Other consecutive call information such as ringing, answering, and terminating events related to the status of the real call is transmitted to the CU (11) via these protocols throughout the real call. The triggers based on called number sequence are provided and widely used in fixed and mobile networks by using INAP or CAMEL protocols. The SU (21) can be configured to trigger any called number sequence to be sent to the defined SCCP GT target address of the CU (11). For example, depending on the country and operator number sequences of the CU (11), a FN (22) as the SU (21) can be configured to trigger these number sequences to the CU (11) in the trigger configurations of the FN (22).

It is important to make clear the difference between these triggers based on number sequence and CAMEL triggers in international roaming. For example, the FNs (22) trigger the network originated real calls, based on the called target country or operator number sequences. As a result of that, the mobile FNs (22) trigger international calls of international roaming subscribers in their networks as well as calls of their subscribers. Meanwhile, the triggers are independent of CAMEL signaling communication which belongs to international roaming subscribers because the triggers are dependent on called number sequences, but independent of which subscriber is actually making the call; so that, the communication is not number sequence based triggers but uses the feature of O-CSI (Originating - CAMEL Subscriber Information) of the protocol.

Along with the convergence of fixed and mobile networks, IMS (IP -Multimedia Subsystem) base networks provide services centrally for different access networks. According to this, SIP (Session Initiation Protocol) may be used for triggers of not only the IMS based FNs (22), but also the NGN (New Generation Networks) based FNs (22). The INVITE initial message of the trigger is sent on behalf of an Application Server of the CU (11), which is configured as a parameter of an Application Service defined in IMS based SUs (21). When the real call in the SU (21) makes a call to the subscriber number of the international destination, the Application Service is activated. Any network supporting SIP such as IMS or NGN networks, besides defining the triggers as an Application Service in IMS networks, may trigger SIP INVITE messages to more than one target by using flexible number based routing configurations in access or gateway SBC (Session Border Controller). This is exactly the same as the number sequence based triggers which are configured at CS based telecommunication networks employing INAP or CAMEL.

The MAP (Mobile Application Part) SRI (Send Routing Information) dialog may be an option as the triggers of the call information from the mobile type FNs (22) to the CU (11). The MAP SRI message may constitute an initial message that is sent to the CSN at SCCP Called Party GT address according to GSM (Global System for Mobile) standards. Even if the SRI message transmits no CNI of the calling party related to the source call, the ON (10) can still prevent the interconnection fraud when the terminated call is received in the ON (10).

Communication between the SU (21) and the CU (11) of the ON (10) may be conducted in two ways. First one is a direct communication between the SU (21) and the CU (11), wherein the SUs (21) use any triggering method as stated foregoing. In direct communication, the SU (21) should configure all the target networks, to which triggers are delivered. Another method as a more practical approach is a central communication where the SUs (21) trigger the real calls to a CDU (24) and the CDU (24) triggers the real calls to one or more CUs (11) of the ONs (10). The central communication makes the communication between the SUs (21) and the ONs (10) easier because the SUs (21) do not have to change their configurations if they make an agreement with an operator to trigger originating calls or any target network changes the configuration of their CU (11). Instead of the foregoing, the CDU (24) may share triggers according to bilateral or unilateral agreements between the SUs (21) and the CUs (11) of the ONs (10) such as between the operators as the SUs (21) and the other operators as the CUs (11).

The bilateral or mutual agreements benefit both the SU (21) and the ON (10). The FNs (22) make sure that the real calls are carried over the legitimate interconnection routes until they reach the target ONs (10). The quality transportation of the outgoing international calls, for which all costs are covered, on the legitimate interconnection routes is an important motivation for the FNs (22). The target operator prevents both interconnection fraud and provides better quality for the terminated international calls. When both parties trigger one another for the real call, they both take maximum benefit.

As for the security and privacy of the call information such as CSNs and CNIs, messages of the triggers may be subject to end-to-end encipherment and may be made over the International Signaling Carriers (23), the VPN (Virtual Private Network) connections, or over the secure internet (27) connections. Taking into consideration the security regulations of the local or regional regulatory bodies, for example, the GDPR (General Data Protection Regulation) of the European Union; the security and privacy standards of the communication of the call information may be fulfilled readily.

Operators or service providers of the SUs (21) can control with which ONs (10) the call information is shared by making agreements with the ONs (10) and the CDUs (24). These agreements correspond to the regulatory, security, and privacy requirements of source and destination networks. The use of the CDU (24) facilitates operational efficiency as well as the security and privacy of call information. The CDU (24) proves to be advantageous for the ONs (10) to centrally adapt to the regional and local regulations.

In another embodiment of the present invention disclosed, the communication between the VUs (21) and the CUs (11) is realized via a dedicated block chain network. The SUs (21) and the CUs (11) of the ONs (10) are connected to this dedicated block chain network. The call information is triggered from the SU (21) to the CU (11) according to an intelligent contract established between the ON (10) of the SU (21) and the ON (10) of the CU (11). The intelligent contract defines the rules of sharing the call information between the ONs (10). Therefore, block chain technology facilities provide transparency and accuracy for the carried call information such as CSNs and CNIs.

The SU (21) triggers the call information of a call to the CU (11) which has the dialing prefix of the CSN. The call information is protected from the SUs (21) and the CUs (11) of other operators which are not a party of the call, within the block chain network. The channel structure is established between the ON (10) of the SU (21) and the ON (10) of the CU (11) within the block chain network. This structure makes the SU (21) and the CU (11) of the operators who have mutual trust to see the data; yet prevents the other ONs (10) from seeing the content of the data. The intelligent contracts and the channel structure between the operator networks help to fulfill the privacy requirements and regulatory rules of the source and target operator networks. It is possible to use a CDU (24) within the block chain network, yet the non-central nature of the block chain technology provides benefits to the ONs (10) by eliminating the need of using a CDU (24) and mediator signaling carriers. As a result, the fact that the triggers related to the call information are transmitted over a block chain network provides a more flexible, more reliable, and more cost-effective solution.

About the transmission methods of the triggers of the Supplier Units (21)

If the source calls have CSNs including the country code of the country of the ON (10), then the triggers of the real calls are transmitted to the ONs (10) in the country to which their subscription belongs. The triggers which make a call to the local subscriber numbers in a country are used to prevent Network Terminated Fraud and CNI Fraud. The local subscriber numbers are the subscriber numbers of the real subscribers of the ON (10).

The transmission of the triggers to the CUs (11) of the ONs (10) which have the subscription can be realized by various alternative methods. In one of these methods, as depicted in the Fig. 2, the SU (21) or the CDU (24) triggers the CU (11) of each ON (10) in a country using multiple triggers. This means that for each CU (11) that newly starts providing service in a country, the FNs (22) or the CDU (24) update their trigger settings to trigger this new CU (11). In this triggering method, the CU (11) of each ON (10) in the country receives the triggers of all the real calls that are made to this specific country. After that, the CUs (11) need to analyze the ON (10) having a CSN subscription by conducting a query of NP (Number Portability) over the NP Database (32).

In another method, again as depicted in the Fig. 2, the CU (21) or the CDU (24) may trigger the CU (11) of the ON (10) only for the number sequences of the ON (10). In this case, the CUs (11) of the ONs (10) receive no triggers of the ported-in subscriber numbers which use the original subscriber numbers of the other national operators in the country If the subscription of the CSN of the trigger belongs to the ON (10) according to the NP query conducted, then the CUs (11) in the country can still perform the fraud prevention method for the CSNs which still use the original subscriber number of their ONs (10).

As a solution to the problem of number portability, the ONs (10) which have the subscription of the triggers need to be determined by SUs (21) or the CDUs (24) and to be transmitted to the ON (10) having the subscription. According to this, in an alternative method as depicted in the Fig. 3, the triggers are sent to a Leading CU (11) of a Leading ON (10) which is an ON (10) that has primarily implemented CU (11) in the country. When a new ON (10) in the country also implements the solution of the CU (11) as a follower of the Leading CU (11), the SUs (21) or the CDU (24) trigger the follower CU (11) of this new follower ON (10) solely for their number sequence, in the meantime, all other number sequences of the country are carried on being triggered to the Leading CU (11). As a solution to the NP problem, when the Leading CU (11) and the follower CU (11) receive the initial messages of the triggers, they conduct NP queries for CSNs using NP Database (32). When they detect a ported-out subscription as an answer to NP queries, the Leading or follower CU (11) sends these initial messages to the CUs (11) of the ONs (10) having the subscription of the CSNs. In this way, each ON (10) implementing the CU (11) solution is triggered for the source calls which makes a call to their subscribers.

In another alternative method as depicted in the Fig. 4, a Central STF (33) is proposed for the detection of ON (10) having the subscription in the country. The triggers are transmitted to the Central STF (33) in the country by means of the SUs (21) or the CDU (24). If the Central STF (33) implements the CU (11) of the ON (10), it transmits the initial messages of the triggers directly to the CUs (11) of the ONs (10) having the subscription. The Central STF (33) conducts NP queries over a NP Database (32) for the CSNs of the triggers to detect the CUs (11) of the ONs (10) having the subscription. In order to be able to select the proper NP solution among all the solutions, a suitable method can be determined by taking the regulation requirements of the operator into account. For example, the Central STF (33) can be operated by a licensed contractor who is under the control of an operator in the country or a regulatory body of the country, or the regulatory bodies may promote a multiple trigger solution or Leading ON (10) solution, instead of proposing a Central STF (33) solution.

In a case where the MAP SRI messages are used for the triggers, the SCCP calling party address of the SRI initial message is assigned as the CSNs of the real calls according to the GSM standards. This entails the transformation of SCCP address in the methods using a Central STF (33) or a Leading ON (10). The SCCP calling party address of the MAP SRI messages is transformed into the SCCP GT address which belongs to the CU (11) of the Leading ON (10) to be able to transmit the triggers to the Leading ON (10). In addition, the triggers of any other CUs (11) are carried on being triggered to the SCCP addresses which are assigned as the CSNs of the real calls. Similarly, the SCCP calling party addresses of the MAP SRI messages are transformed into the SCCP GT address of the Central STF (33). As an alternative to the transformation in the solution of the Central STF (33), each operator in the country can transmit the MAP SRI messages it received from International Signaling Carriers (23) to the SCCP GT address of the Central STF (33). The SCCP address transformation of the SRI messages can be performed in the signaling gateway function of the SUs (21) if there is direct communication between the source and the destination networks or it can be performed by CDU (24) if there is a central communication.

When it is used an optimum call transmit between a mobile FN (22) and the ON (10) in general, the SRI messages can be transmitted between international roaming operators. The SOR (Support of Optimal Routing) feature determined by 3GPP (3rd Generation Partnership Project) provides the calls to connect locally to the international roaming subscribers of the ON (10) without the need for the calls to pass on the network of the called subscriber and return to FNs (22), where the subscriber is in active roaming. A SRI message is sent from FN (22) to the ON (10) for an originating call and the ON (10) responds with a MSRN (Mobile Subscriber Roaming Number) value which directs the FN (22) to set up the call locally. When the SRI messages are used for triggering, the CU (11) of the ON (10) transmits the received MAP SRI initial message to the HLR (35) of the CSN if both the FN (22) and the ON (10) support the said feature of SOR in their networks. The CU (11) understands whether a FN (22) supports the SOR by using a SOR parameter in the received next message.

As an alternative solution to the NP problem, the CDU (24) or SUs (21) may adopt the role of determining which ONs (10) have the subscription of the triggers in addition to triggering the CUs (11). As depicted in the Fig. 5, the CDUs (24) and the SUs (21) forwards the initial messages of the triggers to CUs (11) of the ONs (10) which have the subscriptions if the ON (10) which has the subscription implements the solution of the CU (ll).

There are alternative methods for detecting the ONs (10) that have the subscription. An option is performing a MAP SRI-SM (Send Routing Information for Short Message) process to a HLR (35) of the operator that has the number sequence of the CSN in the country. This process, depending on the NP implementation in the country, responds to the CDU (24) or the SU (21) from either the operator code of the ON (10) that has the subscription or the HLR (35) of the operator that has the subscription. The CDU (24) or the SU (21) determines the ON (10) that has the subscription by using the configurations of the SCCP Calling Party Address of the operators or the operator codes, and the SU (21) or the CDU (24) send an initial message of a trigger to the CU (11) of the ON (10) that has the subscription if the CU (11) of the ON (10) is registered in the CDUs (24) or the SUs (21) to receive the triggers.

In another alternative, as depicted in the Fig. 5, the CDU (24) forwards the triggers to the ONs (10) that have the subscription by conducting NP queries over NP Database (32). A country or an operator in the country can access to NP database. In addition to that, in another alternative as depicted in the Fig. 5, the CDU (24) directs the triggers to the ONs (10) that have the subscription by conducting an ENUM (E. 164 Number to URI Mapping) query to an ENUM Database (34) for the CSN. This query brings the URI (Uniform Resource Identifier) address of the ON (10) that has the subscription, this notifies the ON (10) that has the subscription to the CDU (24). Although the figures depict the CDU (24), also the SUs (21) use the said methods to determine the ONs (10) that have the subscription of the CSN.

For example, in practice, it may not be practical for the FNs (22) to trigger and determine the CUs (11) of the ONs (10) that have subscriptions in many countries and operators. In other words, the direct communication between the SUs (21) and the CUs (11) may seem unnecessary compared to triggering via the CDU (24). However, triggering the source calls directly from the SUs (21) to the CUs (11) may be a reasonable and practical option when the operators of a telecommunication group are taken into consideration and at the same time in view of the fact that the SU (21) may be a CU (11) of the other countries.

Besides receiving the triggers related to the subscriber numbers of the ON (10), the ON (10) can register to the CDU (24) or the VUs (21) in order to receive the triggers of calling international foreign numbers of the VUs (21). These triggers can be used to prevent the Network Originated Fraud by the CU (11) of the ON (10). The CU (11) can control the CSNs of source calls by means of these triggers and detect whether the calls are originating international calls in the ON (10) of the CU (11). Due to the possible high number of triggers from the FNs (22), these triggers make calls to many various international foreign numbers, the ON (10) may need to sample these triggers in a limited amount to detect the Network Originated Fraud. Therefore, the CDU (24), the SU (21), or the CU (11) may prefer to filter a predefined rate of these triggers such that the CU (11) can process them. The limiting of the number of triggers may be adaptively adjusted in the CU (11) depending on the detection of Network Originated Fraud. According to this, the CU (11) can also limit the number of triggers such that it is adjusted per the capacity of processing the triggers. The CU (11) may choose the destination countries or operators of the source calls to trigger. The reason for this is, Network Originated Fraud is much more likely to happen for some selected countries or operators that charge higher termination fees than other destinations. This also helps the ON (10) to manage the number of triggers it receives.

About the generation of test calls

In another embodiment of the present invention disclosed, the CU (11) generates source calls, which make a call to the selected real subscriber numbers as test calls; the said selected real subscriber numbers are local subscriber numbers or roaming subscriber numbers. The local subscriber numbers are the active subscriber numbers of the real subscribers of the ON (10). Roaming subscriber numbers are the subscriber numbers of the real subscribers of the IRPNs (36) of the ON (10) and are in international roaming actively in the ON (10). The test calls are used for detecting the CNI Fraud and the Network Terminated Fraud when the CSN is selected from the local subscriber numbers. The test calls are used for detecting the Network Originated Fraud when the CSN is selected from the roaming subscriber numbers. The CU (11) generates the test calls through direct signaling and using carrier protocols or through communicating with a TCGS (31).

The CU (11) chooses a FNO (Foreign Number Origin) for the test calls and a CNI among the real subscriber numbers such that it corresponds to the selected FNO. The selected FNO indicates FN (22) from which the test call is generated. The selected CNI has a number sequence of the numbering plan of the selected FN (22). In other words, the number sequence of the CNI is selected such that it remains in the original numbering plan of the selected FN (22), even if any operator in the originating country can use these numbering plans due to number portability.

As depicted in the Fig. 6, in a method for generating test calls, the CU (11) generates test calls using a TCGS (31), wherein the TCGS (31) generates test calls using test probes, robots or calling services from the selected FNs (22). The CU (11) sends requests of initiating or terminating the test calls to this TCGS (31), while the TCGS (31) notifies the ringing, answering, and termination information of the test calls to the CU (ll).

As depicted in the Fig. 6, in another method for generating test calls, the CU (11) directly generates the test calls by using signaling and carrying protocols. The generated test calls are transmitted from the IN (12) to one or more Selected Carrier (40) as outgoing international calls. Alternatively, the CU (11) transmits the test calls to Selected Carrier (40) directly. The Selected Carrier (40) transmits the received test calls to the selected Subsequent Carrier (41). At this point, the Selected Carrier (40) keeps a FNO list for each Subsequent Carrier (41), and the said list indicates from where the Subsequent Carrier (41) carries traffic and the Selected Carrier (40) selects this Subsequent Carrier (41) if one of the Subsequent Carriers (41) includes FNO of CNI of the test call in its list. In this method, the test calls essentially do not come from FNs (22). Thus, the test calls return from the Subsequent Carriers (41) and this method provides the test calls to pass through many common routes of the International Traffic Carriers (25) until they reach the ON (10). This method in fact facilitates sampling international traffic passing through the International Traffic Carriers (25).

A test call is normally expected to be transmitted back to the ON (10) via legal interconnections when the CSN is a local subscriber number regardless of being generated from a selected FN (22) by a TCGS (31) or being generated from a selected FNO by a Selected Carrier (40). Even if it comes from the interconnections this termination can be a CNI Fraud. However, if a carrier from International Traffic Carriers (25) transmits the call to the FU (30) via the internet (27), then the FU (30) terminates the test call to the CSN as an originating international call. The FU (30) makes calls through a Radio Base Station (17) of the mobile ON (10) or a Subscriber Access Interface (20) of the non-mobile ON (10).

Similarly, as depicted in the Fig. 6, the test call is normally expected to be transmitted to the IRPN (36) of the CSN when the CSN is a roaming subscriber number regardless of being generated from a selected FN (22) by a TCGS (31) or being generated from a selected FNO by a Selected Carrier (40). However, if a carrier from International Traffic Carriers (25) transmits the call to the FU (30) via the internet (27), then the FU (30) makes an originating international call to the CSN for performing the Network Originated Fraud. Normally, the ON (10) forwards the international call to the roaming subscriber number as an outgoing international call, or the ON (10) can connect the call using the feature of optimum call transmission to the called roaming subscriber number. The FU (30) makes calls through a Radio Base Station (17) of the mobile ON (10) or a Subscriber Access Interface (20) of the non-mobile ON (10).

The CU (11) controls the terminated calls of the CSN in the ON (10) in order to be able to prevent the test call from ringing the local subscriber number. The CU (11) is able to do this because the local subscriber numbers are the subscriber numbers of the ON (10). If the source calls are triggered from the SUs (21) as in the real calls that make a call to the local subscribers of the ON (10), then the CU (11) carries on the terminated calls of the CSN since these calls are the real terminated calls of the CSN.

The CU (11) generates the test calls such that it makes a call to the roaming subscriber numbers which are the subscriber numbers of the real subscribers of the IRPNs (36) of the ON (10) and which are in active international roaming in the ON (10). Similarly, the CU (11) controls the terminated calls of the CSN in the ON (10) to be able to prevent the test call from ringing the roaming subscriber number. On the other hand, the CU (11) receives the triggers of the SUs (21) which make a call to the international foreign numbers. Although the CU (11) controls these called international foreign numbers as CSNs to understand if they are an originating international call in the ON (10), since these international foreign numbers are not the subscriber numbers of the ON (10), the CU (11) does not need to stop or carry on the terminated calls to these numbers.

As depicted in the Fig. 6, a test call that makes a call to the roaming subscriber number is generated by the CU (11) and the IN (12) transmits the test call to an International Traffic Carrier (25). Alternatively, the CU (11) can request from a TCGS (31) and this TCGS (31) initiate the test call from a FN (22) so that the FN (22) transmits the call to an International Traffic Carrier (25). In a normal transmission of the CSN, the IRPN (36) of the CSN receives the test calls from International Traffic Carriers (25) as incoming international calls. The IRPN (36) performs a query to HLR (35) of the called roaming subscriber number since the called roaming subscriber number is roaming in the ON (10) at the exact time and HLR (35) sends the PRN (Provide Roaming Number) message which requests a MSRN (Mobile Subscriber Roaming Number) transmission number to the ON (10), in order to forward this incoming call to the roaming subscriber number. In order to receive incoming PRN messages in the CU (11), the PRN messages from the IRPNs (36) are transmitted to the ON (10) via the CU (11). If the CU (11) has received a PRN message for the CSN, and if the CU (11) has not yet associated an originating international call with the CSN in the ON (10), then this means that the test call has reached the destination IRPN (36) via the International Traffic Carriers (25). If the CU (11) has determined an associated originating international call for the called Roaming Subscriber Number or the CSN before receiving a PRN for the CSN, then this means that a carrier amongst the International Traffic Carriers (25) has transmitted the test call to the FU (30), instead of the IRPN (36). And this means that the FU (30) has made an originating international call in the ON (10) via a Radio Base Station (17) or a Subscriber Access Interface (20). The CU (11) terminates the test call and carries on the MAP PRN message associated with the CSN to the ON (10) whether it is associated with the CSN of an originating international call. The reason behind carrying on the PRN message is that, if the PRN message was sent for another coinciding subscriber call from the IRPN (36) and if it arrived before the PRN of the test call, then this coinciding subscriber call would have been carried on being established without causing a call failure to the visiting roaming subscriber.

In short, in the said method of generating the test calls, Network Originated Fraud is detected by means of the test calls making a call to the Roaming Subscriber Numbers. The said the test calls are initiated from the FNs (22) by means of the TCGS (31), which TCGSs (31) may initiate the test calls from many FNs (22) all over the world. These test calls may be transmitted to the FU (30) by means of a carrier amongst the International Traffic Carriers (25), or the test calls may be initiated such that they are sent from the CU (11) directly to the Selected Carriers (40) and the Subsequent Carriers (41), respectively. Also, a Subsequent Carrier (41) or any other carrier can transmit the test call to the FU (30). The FU (30) does not know that the CSN is a subscriber number of an active roaming subscriber in the ON (10) yet perceives this number only as a destination number to which the call needs to be delivered, by exploiting advantageous international call tariffs of the ON (10). The FU (30) may use various access types such as “SIM Box” numbers or PBX (Private Branch Exchange) lines, SIP Trunk lines, fixed Subscriber Access Interfaces (20) such as fixed subscriber lines. Thus, the CU (11) detects this CNI of the originating international call as Detected Fraud Number.

In another embodiment of generating the test calls, the CU (11) directly generates the test calls which make calls to subscriber numbers associated with test SIM (Subscriber Identity Module) cards of the IRPNs (36) of the ON (10). The CU (11) makes a location update for each and every subscriber number. The subscriber number is selected such that it corresponds to the selected FNO, in this case the said FNO is the network of the selected subscriber number. As depicted in the Fig. 6, similar to generating the test calls to Roaming Subscriber Numbers, in the CU (11) a PRN message is received from the IRPN (36) for the CSN of the test SIM card via the International Signaling Carriers (23). Since a location update is performed on this subscriber number as VLR (Visitor

Location Register) in the CU (11), the ON (10) directly transmits the PRN messages to the CU (11) without requiring a dedicated routing configuration. Test SIM card subscriber numbers can be detected by the fraudsters and can be transmitted from normal interconnections. Therefore, it is not expected to terminate the test calls with the detection of Network Originated Fraud. The CU (11) sends back a local subscriber number as a MSRN, this causes the IRPN (36) to transmit the received incoming international call back to the ON (10) via the International Traffic Carriers (25), and this means the test call is made to the sent local subscriber number as the CSN. In this way, the CU (11) generates the test calls that make a call to the local subscriber numbers selected from the IRPNs (36). The test calls are used for detecting the CNI Fraud and the Network Terminated Fraud.

The Fig. 6 also shows another way to use the subscriber numbers of the test SIM cards. The CU (11) selects a roaming subscriber number and returns this number as a MSRN when a PRN is received from an IRPN (36) for the CSN of the test SIM card selected in the CU (11) via the International Signaling Carriers (23). However, this time, the Roaming Subscriber Number sent is selected from a country different from the country of the IRPN (36) of the selected test SIM card. In this way, the test call is forwarded to the International Traffic Carriers (25) by the IRPN (36), as an outgoing international call that makes a call to the selected roaming subscriber number of a different IRPN (36). Thus, a test call is transmitted from a selected IRPN (36) to the network of the selected roaming subscriber number as an outgoing international call. The said test calls generated between different IRPNs (36) of the ON (10) can be used to detect Network Originated Fraud. For example, the call can be carried as an originating international call over the ON (10) by means of a Radio Base Station (17) or by means of a Subscriber Access Interface (20) of the FU (30) instead of being forwarded to the network of roaming subscriber number if a carrier transmits the call to a FU (30) via the internet (27) while proceeding in the International Traffic Carriers (25). The incoming MAP PRN messages from the IRPNs (36) are transmitted via the CU (11) in the ON (10). Therefore, when a MAP PRN message is received for a Roaming Subscriber Number, the CU (11) terminates the test call and subsequently the CU (11) carries on the received MAP PRN message to the ON (10).

About generating test calls adaptively

Fraudsters can survive even if they use SIM Box number for example for half an hour in the Network Originated Fraud and Network Terminated Fraud. The fraudsters continue their fraud by including new “SIM Box” numbers in the line. Particularly, the capacity of the CUs (11) and the TCGSs (31) or the budget of the operators may be limited for generating many test calls from various FNOs Thus; focusing the test call sources on FNOs, where detecting of interconnection fraud is initiated, dynamically on a time basis, allows the ONs (10) to benefit at maximum from these test call sources and leave minimum space for the fraudsters. Therefore, the test calls are adaptively generated corresponding to the detection thereof as Network Originated Fraud, Network Terminated Fraud, and CNI Fraud based on their FNOs.

According to the method, the CU (11) determines the daily total number of the test call to be generated and distributes the number proportional to data of incoming international traffic in the ON (10), into the predefined equal time intervals of a day. A predefined FNQ (Foreign Network Quota) for each FNO is determined per each time period. These predefined FNQs are the number of the test calls made from each FNO for each time period proportionally to the daily traffic received from FNs (22) in the international traffic data.

For each new time period and each FNO: The CU (11) determines a new FNQ adaptively. The CU (11) increases the determined FNQ value of the previous time period by a predefined rate if at least one of the test calls is detected as interconnection fraud during the previous time period. The CU (11) decreases the determined FNQ value of the previous time period by a predefined rate if none of the test calls is detected as interconnection fraud during the previous time period. This determined FNQ at a time period may vary between a predefined minimum and maximum value of predefined FNQ of each FNO.

About processing triggers of the Supplier Units (21) adaptively

The processing capacity of the CU (11) needs to prioritize triggers that make calls from specific SUs (21) to specific destinations. The CU (11) adaptively processes source calls of the SUs (21), based on the FND (Foreign Network Destination) related to the called international foreign numbers and the SU (21) in conformity with the detection of interconnection fraud. The FND is determined similarly to determining a FNO before selecting the CNI of a test call and selecting the CNI corresponding to the numbering plan of the selected FNO. The FNDs of the called international foreign numbers of the source calls are determined by the CU (11) according to number sequences of international foreign numbers. For example, for a called international foreign number in the form of + <Country Code<National Destination Code> <Subscriber Number>, the CU (11) may determine the FND of this called number according to the country or operator codes that match <Country Code> and <National Destination Code> values obtained from the number.

For example, the FU (30) makes the ON (10) originated international calls if a FU (30) receives FN (22) originated international calls, wherein the FN (22) is a SU (21), and these calls make a call to the FND. When the CU (11) detects CNIs of the originating international calls as Detected Fraud Number, the CU (11) adaptively increases the number of processed triggers from the pair of the SU (21) and the FND. This helps the CU (11) to detect interconnection fraud in an efficient and quick manner. Because the CU (11) increases the volume of the processed triggers for the SU (21) and the FND where the manipulative traffic is originated. It makes sense to select specific FNOs for a SU (21) in the case of Network Originated Fraud, since this manipulative traffic may only be flowing to certain destinations related to the FNDs that have higher termination fees compared to the other destinations. In the Network Terminated Fraud and CNI Fraud, the FND is the destination of the ON (10) since the CU (11) is triggered from the SUs (21) for the subscriber numbers of the ON (10).

According to the method, the CU (11) determines the daily total number of the source calls which need to be processed as the triggers from the SUs (21) and distributes the said number into the predefined equal time intervals of a day. This distribution is performed proportionally to the average number of the triggers received in the relevant time periods during this day of the week. The distributed value of the total number is divided into TUQ (Trigger Unit Quota) values proportional to the number of triggers received from each pair of the SU (21) and the FND for each time period. The said TUQ values are recorded as predefined TUQs, which predefined TUQs are the number of the source calls to be processed from each pair of the SU (21) and FND for each time period.

The CU (11) adaptively determines a new TUQ for each pair of the SU (21) and the FND in each new time period. The CU (11) adaptively increases the determined TUQ for the previous time period by a predefined rate if at least one of the source calls is detected as interconnection fraud during the previous time period. And the CU (11) adaptively decreases the determined TUQ for the previous time period by a predefined rate if none of the said source calls is detected as interconnection fraud during the previous time period. Adaptively the determined TUQ in this time period may vary between the two values determined by a predefined minimum and maximum ratios of the predefined TUQ of the pair of the SU (21) and the FND.

About the collection of real subscriber numbers for test calls

The CU (11) periodically collects the recently used real subscriber numbers in the ON (10) and updates them in a number pool to be selected for the test calls. The calling party numbers of the triggers of the said originating international calls are collected using the triggers of the originating international calls of the ON (10) which can be triggered from the ON (10) to the CU (11) for detecting the Network Originated Fraud, and these are collected as local subscriber numbers if the said calling party number belongs to a visiting roaming subscriber. Since the calling numbers make a call to an international destination, they are also more likely to receive international calls. The fraudsters keep a blacklist related to the called party numbers, which called party numbers are generally the test numbers that are used to detect interconnection fraud by the operators. The reason for collecting these numbers is most probably to choose the real subscriber numbers included in the white lists of the fraudsters. Similarly, the calling party numbers of the triggers of the originating international calls are collected and used as roaming subscriber numbers if said calling party number belongs to a visitor roaming subscriber. The called party numbers are collected as CNIs, using the triggers of originating international calls in order to select the CNIs from the real numbers for similar reasons.

The subscriber numbers of the terminated international calls are also collected and kept in the number pool. The CSNs and the CNIs are collected from the CDRs of the international incoming calls of the subscribers of the ON (10). These numbers are updated in the number pool, wherein the CSNs thereof are kept as local subscriber numbers. Similarly, the roaming subscriber numbers are collected from the CDRs of the visiting roaming subscribers in the ON (10). The CDRs may be obtained from the charging system or signal monitoring system of the ON (10). The real subscriber numbers may be collected from the CDRs by a process of the CU (11) or may be provided in a database by the ON (10).

The CU (11) needs to know which roaming subscriber numbers are actively roaming in the ON (10) to generate the test calls. In a method, the CU (11) regularly collects roaming subscriber numbers from VLR systems of the ON (10) via the instruction row interface. In another method, the CU (11) can collect roaming subscriber numbers from the PRN messages related to a request of call incoming recently, since the CU (11) reads all the MAP PRN messages coming from international networks.

The CU (11) needs to control whether a subscriber number is still actively roaming in the ON (10), before initiating a test call to a roaming subscriber number. In addition to controlling the presence of the roaming subscriber number, the CU (11) also controls whether the roaming subscriber has the features of CFU (Call Forwarding Unconditional) in the VLR subscription data or blocking incoming calls. If these controls are not performed before the test calls, the test calls may not be received back from the network of the visiting roaming subscriber towards the ON (10). Similarly, the CU (11) can select a local subscriber number before initiating a test call if this local subscriber number is not roaming outside the ON (10). This precaution prevents the test calls from connecting to the selected local subscriber numbers in a FN (22) depending on the optimum call forwarding in the visited FN (22) while in international roaming. The CU (11) may perform a MAP SRI-SM process for the said local subscriber number in order to obtain current VLR information.

About determination of IRSC of terminated calls In an embodiment of the present invention disclosed, when the source calls reach the ON (10), the ON (10) triggers the terminated calls of the CSNs to the CU (11) in signaling. The source calls may be triggered from the SUs (21) or may be generated by the CU (11). The source calls terminate to the ON (10) either as normal termination or as the CNI Fraud via normal interconnection routes. These terminated calls are triggered from the ON (10) to the CU (11) due to a variation in the subscription profile of the CSN. This variation is performed by the CU (11) before the source call reaches for receiving the triggers of the terminated calls of the CSN. In the Network Terminated Fraud, the source calls can be received as originating national calls from the FUs (30). These calls are triggered from the ON (10) to the CU (11) as the triggers of the terminated call of the CSN due to this variation in the subscription profile of the CSN.

In the Network Originated Fraud, the source calls are received as originating national calls from the FUs (30). The CU (11) cannot perform a variation in the subscription profile of a foreign subscriber number since the CSNs are international foreign numbers. Therefore, as a solution, the ON (10) is configured to trigger all originating international calls to the CU (11). This makes it possible for the CU (11) to be able to associate all originating international calls made to the CSNs. The originating international calls related to the associated triggers are the terminated calls of the CSNs. These CSNs are either the roaming subscriber numbers related to the generated test calls or international foreign numbers related to the triggers received from the SUs (21). After determining the terminated calls of the CSNs, the CU (11) determines one or more IRSCs of each determined terminated call and matches them with the CSN. If the source calls are the test calls, then the CU (11) does not allow the terminated calls to connect with the CSNs unless they are detected as coinciding subscriber numbers. On the other hand, if the source calls are triggered from the SUs (21), then the CU (11) carries on the terminated calls to connect to the CSN.

In another embodiment of the present invention disclosed, the CU (11) uses the associated network CDRs of the ONs (10) to determine the terminated call of the CSN. Similarly, the CU (11) determines one or more IRSC values for each determined terminated call and matches them with the CSN. The CU (11) can control the terminated calls via the associated network CDRs without the need for intervention to the terminated calls since the source calls triggered from the SUs (21) generally connect to the CSN. However, when the source calls are the test calls the CU (11) performs a CFU (Call Forwarding Unconditional) variation in the subscription profile of the CSN before the source call reaches the ON (10) since the CU (11) needs to prevent the CSNs from ringing. This variation forwards the terminated calls of the CSN to the CU (11). Thus, the CU (11) allows detected coinciding calls to connect with the CSN but does not allow for other terminated calls to connect. The IRSC includes a Type Code, an Operator Code, and an Operator Information. The value of the Type Code takes the value of International if the terminated call is received via an international interconnection route, National if the terminated call is received via a national interconnection route, Internally Originated if the terminated call is originated in the ON (10), or Internally Terminated as absence value Internally Terminated means that the terminated call is received via other types of internal routes in the ON (10). Each interconnection partner of the ON (10) and each national operator in the country of the ON (10) is assigned a dedicated code value in the CU (11). This Operator Code of the IRSC is a dedicated code value related to the interconnection partner from which this terminated call from the ON (10) is received. The Operator Information is an Operator Code related to the operator having the subscription of the CNI of the terminated call. The operator having the subscription is either any national operator in the country of the ON (10) or any interconnection partner of the ON (10) A national operator in the country is called the interconnection partner of the ON (10) if the ON (10) has an interconnection with the national operator. The ON (10) may not have interconnection with all national operators in the country. The national operators in the country are the operators that use the national subscriber numbers of the country. The CU (11) determines the operator having the subscription by conducting a NP query for the CNI.

About the determination of IRSCs via the triggers of the terminated calls

In an embodiment of the present invention disclosed, the IRSCs of the CSN are determined via the triggers of the terminated calls of the CSN. The CU (11) firstly determines one or more terminated calls of the CSN. After that, the CU (11) matches the determined IRSCs with the CSN of the source call. Meanwhile, the source call is generally expected to be received as a single terminated call, independent of the method of triggering or the method of associated network CDRs. In addition, there may be special circumstances causing receiving a plurality of terminated calls for the CSN. This is the reason of a plurality of terminated calls can be determined. According to this, at least one terminated call related to the source call needs to be determined for detecting the interconnection fraud, otherwise, this source call cannot be considered in terms of fraud. For example, one of the fraudsters may implement alternative routing to break the detection algorithms of the operators during the CSN control. In the alternative routing, the fraudster firstly routes the international call through a legal interconnection route. After they receive a ring or even an answer from the CSN, they make a second call with a type of interconnection fraud while holding originating part of the real call. In this exemplary scenario, detecting a plurality of terminated calls makes it possible to detect Network Terminated Fraud during the control of the real call in each case.

The triggers carry an Inbound Route Information related to the route the terminated call entered in the ON (10). This Inbound Route Information is a dedicated code value that is assigned for the inbound route of different types in the ON (10). This inbound route may be an interconnection route or an internal route of the ON (10). The Inbound Route Information of the terminated calls are pre-configured in the trigger configuration of the ON (10), and they are added to these triggers as a parameter. The Inbound Route Information determines the Type Code or Operator Code values of the IRSC. The CU (11) determines the Type Code or Operator Code values from the Inbound Route Information by using a pre-configured mapping. The Inbound Route Information is added to the triggers in the trigger configurations of the ON (10). The configuration in the mapping data of the CU (11) is similar to the configuration in the trigger settings in the ON (10). For example, if a terminated call enters the ON (10) through a national interconnection route related to an interconnection partner named ‘Carrier X’, then the trigger setting of a mobile ON (10) in the IN (12) assigns the value ‘10’ which is a dedicated code value assigned to this interconnection route as an Inbound Route Information. After receiving the trigger related to the CSN from the IN (12), the CU (11) uses a pre-configured mapping and obtains the values of the pair of Type Code and Operator Code corresponding to the value ‘10’ which is the Inbound Route Information. In accordance with this example, the value of the Type Code indicates the National value since the terminated call is received via the national type interconnection route. And the exemplary code value of ‘3’ which is assigned to ‘Carrier X’ that is a national operator indicates the Operator Code. The triggers carry the CNI of the terminated call. The CU (11) determines the Operator Information related to the IRSC by conducting a NP query for the CNI. In accordance with the example, if the subscription of the CNI belongs to the ‘Carrier X’ that is an interconnection partner, then the Operator Information of the IRSC takes the value ‘3’. In addition to that, if the CNI belongs to another national operator in the country other than the interconnection partner of the call, then this Operator Information takes the Operator Code value of the other national network. The CU (11) controls the CSN during the source call. The CU (11) can terminate control of the CSN after a pre-configured maximum control period from the start of the source call by considering that some calls may take a long time after being answered. Although the control of the source call has a pre-configured maximum control period, the control of the CSN can be completed by the KB (11) earlier than the said maximum check time. The CU (11) can complete the said control earlier if this terminated call is a normal termination or it is detected as an interconnection fraud and if the CU (11) does not feel the need to control for alternative routing for the terminated call. This control may also expire before the timeout of the maximum control period, due to the source call being terminated for any reason. The expiration of the control is implemented regardless of the IRSC is determined through the associated triggers or the associated network CDRs.

The CU (11) associates the triggers received from the ON (10) in real-time to be able to determine the terminated calls of the CSN during the control of the CSN. As soon as an associated trigger of the terminated call is determined, the CU (11) determines one or more of the IRSC of this associated trigger in real-time. The CU (11) implements the method of detecting interconnection fraud on one or more determined IRSCs in real time for each determined terminated call during the control of the CSN. The CU (11) assesses each terminated call without waiting for the next possible trigger that causes a delay. For example, if the CU (11) determines an IRSC that indicates a Type Code value of Internally Originated and if the CSN is a national subscriber number, then the CU (11) detects the terminated call as Network Terminated Fraud and completes the control of the CSN. Meanwhile, the CU (11) may terminate its process before the control of the CSN. For example, if the source call is a generated test call of the CU (11), then the CU (11) firstly terminates the test call and then carries on the terminated call to connect with the CSN in the case the terminated call can be coinciding subscriber number instead of being the terminated call of the generated test call. For example, if the CU (11) determines an IRSC that indicates a Type Code of National value, then the CU (11) can carry on the control of the CSN to detect the terminated calls related to the probable next alternative routing regardless of the terminated call being detected as CNI Fraud. The real-time control of the IRSC is implemented regardless of whether IRSCs are obtained from the associated triggers or the associated network CDRs. When the CU (11) receives a source call triggered from the SU (21) for the CSN or just before it generates a test call, the CU (11) performs a variation in the subscription profile of the CSN via the subscription interface of the ON (10). This variation is only implemented to the local subscriber numbers, the said local subscriber numbers are the subscriber numbers of the real subscribers of the ON (10). This variation makes it possible to trigger the terminated calls of the CSN to the CU (11) as signaling. This variation in the CSN profile is retrieved upon completion of the control of the CSN.

In an embodiment of the method, the CU (11) is triggered as an Application Service with the SIP. This variation in the subscriber profile includes a definition of an Application Service. The Inbound Route Information is the Operator Identifier values carried in the received-realm parameter in the Via header of the SIP INVITE message. Alternatively, the Inbound Route Information are FQDNs (Fully Qualified Domain Name), or IP (Internet Protocol) addresses carried in Via header of the SIP INVITE message. Since SIP adds a Via header in each SIP unit along the call route, or it can add Operator Identifiers depending on the configurations of these SIP units, the CU (11) can obtain a plurality of Inbound Route Information from these parameters. Indeed, the CU (11) uses a pre-configured mapping to obtain the Type code and Operator Code values of the IRSC from the parameter values related to the Inbound Route Information in the INVITE message. For example, a specific Operator Identifier value or a specific FQDN value corresponds to an Inbound Route Information, which is mapped to specific Type Code and Operator Code values in the mapping configuration. Thus, unmatched parameters are discarded by the CU (11) as they do not belong to SIP units in the ON (10). The CNI of the terminated call is carried in the Telephony URI parameter inside the From header of the SIP INVITE message and the called party number is carried in the Telephony URI parameter inside the To header of the SIP INVITE message. This variation in the subscriber profile of the CSN comprises a DH (Default Handling) parameter, the said DH value takes a value that means mandatory for said source calls generated as test calls and takes a value that means non-mandatory for source calls triggered from the SUs (21). If the source call of the CSN is a test call generated by the CU (11), the CU (11) does not allow the terminated calls to connect with the CSNs by controlling the terminated calls over the triggers. When the control of the terminated call is mandatory in the ON

(10), the ON (10) cannot carry on the incoming call unless it receives a reply from the CU (11) for a trigger. The reason for this is to guarantee that the ON (10) always connects the incoming calls with the CSN as a precaution to any probable operational failure in the CU (11) or any communication problem with the CU (11) on the ON (10) side.

If the source call of the CSN is triggered from the SUs (21), the SU (11) allows the terminated call to connect with the CSN. In this case, the control of the terminated calls is non-mandatory in the ON (10). The ON (10) may carry on this incoming call when there is no reply from the CU (11) for the trigger during the predefined timeout period in the ON (10) based on the DH parameter. The reason for this is to guarantee that the ON (10) will always connect the terminated calls to the CSN as a precaution to any probable operational failure in the CU (11) or any communication problem with the CU

(11) on the ON (10) side.

In another embodiment of the method, the CU (11) is triggered as SCF with an INAP or CAMEL protocol. The variation of the subscriber profile comprises a TDP (Trigger Detection Point) definition which is for the terminated calls in INAP. The variation of the subscriber profile comprises a T-CSI (Terminating Camel Service Information) definition which is defined in CAMEL protocol and the HLR (35) of the CSN. In the INAP and CAMEL protocols, the Inbound Route Information is carried in the Service Key parameter of the IDP message. Unlike the SIP, the IDP carries a single Service Key value, which value indicates only an Inbound Route Information in the trigger. According to this, the Inbound Route Information only indicates the Type Code and Operator Code of an IRSC. The CNI of the incoming call is carried in the Calling Party Number parameter of the IDP message and the calling party number of the incoming call is carried in the Called Party Number parameter of the IDP message, in both INAP and CAMEL protocols. The variation in the subscriber profile comprises a DCH (Default Call Handling) parameter in both INAP and CAMEL protocols, the said DCH value takes a value that means mandatory for the said source calls generated as test calls and takes a value that means non-mandatory for source calls triggered from the SUs (21).

The control of the terminated call is mandatory for the source calls which are the test calls generated by the CU (11). The reason for this is that CU (11) must prevent the called real subscriber numbers from being disturbed. The ON (10) does not carry on the terminated call unless it receives a trigger response from the CU (11), which stops the test call from connecting with the CSN. On the other hand, the control of the terminated calls is not mandatory for the source calls triggered from the SUs (21) such as the real calls of the FN (22). In this case, the real calls generally need to connect to the CSNs. Therefore, the CU (11) can carry on the terminated call if no trigger response is received from the CU (11) as a precaution to any probable operational failure in the CU (11) or any communication problem with the CU (11). To be able to set this behavior as mandatory and non-mandatory, a DCH value is sent in the CSN profile. The DCH is like a DH parameter set in the Application Service profile of the CSN in the SIP.

The Fig. 7 shows the triggers of the terminated calls in the ON (10) for a mobile base network. When the terminated call is received by the IN (12), the IN (12) performs a MAP SRI process with the HLR (35) of the CSN, and this process returns a T-CSI parameter, which T-CSI parameter causes IN (12) to trigger the terminated call to the CU (11) using an IDP message of the CAMEL protocol. This is because the CU (11) is configured as the SCCP GT address in the ON (10) of the SCF indicated by the T-CSI parameter. The T-CSI parameter is set in the profile of the CSN before generating the test call or after receiving a trigger from a SU (21). When the CU (11) takes the trigger and associates it to the CSN by using the Called Party Number parameter of the IDP, the CU (11) determines the IRSC value of the associated trigger. Since the terminated call entered to ON (10) via an IN (12), the IRSC value of the terminated call contains a Type Code indicating an International or National value depending on whether the incoming interconnection route is a national or international route. And the CU (11) maps the CSN which it controls to said IRSC.

If a source call associated with the CSN is a generated test call, then the CU (11) may decide to answer the terminated call. In order to answer it, the CU (11) sends a trigger response to the IN (12), which can be CAMEL Connect or an ETC (Establish Temporary Connection) message containing a test number to connect. The IN (12) transmits the terminated call to the said test number upon receiving the message. The ON (10) is configured to transmit the test number to the CU (11) and terminate the same. Thus, the CU (11) can answer the terminated call. If the source call is triggered from a SU (21), for example, if it is a real call, the terminated call is carried on with a CAMEL Continue message as a trigger response to the IN (12). After carrying on this real call, the IN (12) performs a second MAP SRI process with HLR (35), which returns an MSRN value. The IN (12) sends the terminated calls to the MSC (Mobile Switching Centre) determined by the said MSRN, in other words to the SN (13), where the terminated call is connected to the User Device (42) of the CSN.

As depicted in the Fig. 7, in the case of Network Terminated Fraud or Network Originated Fraud, the FU (30) terminates the call to the SN (13) of the ON (10) over a Radio Base Station (17) using a “SIM Box” number. When the SN (13) performs a MAP SRI process with the HLR (35) and the T-CSI parameter set in the CSN profile is returned as a response, the terminated call is triggered by a CAMEL IDP to the CU (11). When the CU (11) takes the trigger and associates it to the CSN by using the Called Party Number parameter of the IDP message, the CU (11) determines the IRSC value of said trigger. The IRSC indicates a Type Code value of Internally Originated in accordance with the Service Key value set in the SN (13). The CU (11) maps the IRSC to the CSN and determines the CNI of the trigger as the Network Terminated Fraud Number Inside the Network. For example, if the source call is a real call, then the CU (11) carries on the call and the terminated call is connected by the SN (13) to User Device (42) of the CSN.

In the mobile networks, the international terminated calls can be triggered to CSN in the INs (12). This is because the HLR (35) of the CSN sends the trigger parameters to the IN (12) in response to the MAP SRI message so that the terminating services of the CSN can be triggered. However, in the non-mobile networks, the calls are normally entered from the INs (12) and reach the final SN (13) of the CSN, and after that, these calls are triggered to the services of the CSN which control the terminated calls.

The Fig. 8 shows the triggers of the terminated calls in the ON (10) for a fixed network, which can be a traditional PSTN (Public Switched Telephone Network) or a NGN network supporting the SIP. When the terminated call is received from the IN (12), the IN (12) transmits the call to the SN (13) of the CSN. In the case of the INAP, the SN (13) triggers the terminated call to the CU (11) using an INAP IDP message, due to the TDP setting which is for terminated calls in the subscription profile of the CSN that is set by the CU (11) to receive triggers. After associating the trigger to the CSN by using the Called Party Number parameter of the IDP message, the CU (11) determines the IRSC value of the associated trigger. The IRSC value set for this trigger normally includes a Type Code value of Internally Terminated. The trigger configuration of the IN (13) can add a Service Key that indicates an internal route of the ON (10) from the IN (12) or another intermediate node in the ON (10). This is because the CU (11) has no information regarding the terminated call entering the ON (10) via an interconnection route of the IN (12).

The CU (11) can answer the terminated call if the source call is a generated test call or carry on the session if the source call is a real call. The real calls carried on connect to the User Device (42) of the CSN. If the FU (30) terminates the call using a Subscription Access Interface (20) related to the FU (30), the SN (13) triggers the CU (11) similarly for the CSN. However, this time, the determined IRSC of the trigger includes a Type Code value of Internally Originated. The Fig. 9 shows the triggers of the terminated calls in the ON (10) for an IMS network, wherein the said IMS networks may provide service for different fixed or mobile access networks. When the terminated call is received by SBC as the IN (12), the IN (12) transmits the call to I-CSCF (45). I-CSCF (45) requests S-CSCF (Serving-Call Session Control Function) information of the CSN from the HSS (43) using the Diameter LIR (Location Info Request) process. The I-CSCF (45) transmits the terminated SIP call as SN (13) to the S-CSCF. If the S-CSCF does not have an active source for the CSN, the SN (13) requests a subscription profile from the HSS (43) by using the Diameter SAR (Server Assignment Request) process. Upon receiving the Application Server Subscription Information data from the profile data, the SN (13) triggers the Application Service of the CU (11) along with other services of CSN. After associating the trigger to the CSN using the Telephony URI parameter inside To header of the INVITE message, the CU (11) determines one or more IRSCs of this associated trigger and maps them to the CSN.

If a source call of the CSN is a generated test call, then the CU (11) may decide to answer the terminated call. The CU (11) can terminate the SIP session and answer the session. If the source call is triggered from the SU (21), for example, if it is a real call, the INVITE message of the terminated SIP call is carried back to the SN (13). The SN (13) transmits the INVITE message to the User Device (42) of the CSN. In order to keep track of end-to-end occurring events of the SIP call such as terminating, ringing, or answering, the CU (11) can add itself to the Record-route header and the Via header of the INVITE message. If the source call is a generated test call, the SN (13) cannot carry on the terminated call without a response from the CU (11), since the Default Handling setting in the filter criteria definitions related to the Application Service for CSN is mandatory. Therefore, if the CU (11) decides to terminate the SIP call, it returns a final response to the SN (13) for the INVITE message and the SN (13) does not carry on triggering other services of the CSN and terminate the session setup. In the case of Network Terminated Fraud or Network Originated Fraud, the FU (30) terminates the call to the P-CSCF (44) or A-SBC (Access-Session Border Controller) of the ON (10) over a Radio Base Station (17) using a number such as a “SIM Box” number. The P-CSCF (44) transmits this originating call to the I-CSCF (45) to determine the S-CSCF of the called subscriber and the I-CSCF (45) transmits the INVITE message to the S-CSCF. Similarly, the SN (13) triggers the CU (11) by transmitting the INVITE message to the CU (11). After associating the trigger to the CSN using the Telephony URI parameter inside To header of the INVITE message, the CU (11) determines one or more IRSCs of this associated trigger and maps them to the CSN.

As depicted in the Figs. 8 and 9, in non-mobile networks, when a SN (13) triggers the terminated call, the ON (10) needs to be configured to provide the Inbound Route Information to the CU (11). Otherwise, the triggers of the SN (13) only indicate the Type Code value of Internally Originated, and the ON (10) indicates the Operator Code having its Operator Code. There are two methods to solve this problem. The first method is to carry the Inbound Route Information up to SN (13) in the carrier protocol to provide the Inbound Route Information related to the first entry point of the terminated calls to the ON (10). The second method is to trigger all incoming calls to the CU (11) in the INs (12) so that the CU (11) associates the terminated calls with the CSN.

According to the Fig. 8 and the Fig. 9 in the first method, the Inbound Route Information related to the incoming terminated calls from the interconnection routes, or the Inbound Route Information related to the originating calls in the ON (10) are carried to the SN (13) in the parameter areas of the call carrying protocol. The SN (13) uses the values of these parameter areas as the Inbound Route Information of the terminating call and adds them to the triggers.

The number analysis and routing settings in the IN (12) for the INAP protocol can add a dedicated prefix to the called party number of the carrier protocol. Thus, a dedicated prefix is assigned for each different interconnection route in the ON (10). When the call is received in the SN (13), the trigger configurations of the SN (13) are configured to assign the Service Key value of the IDP message to the value of this prefix according to the received prefix, which Service Key value is used as Inbound Route Information in the CU (ll).

The Operator Identifier, FDQN, or IP information in the Via header are carried up to the CU (11) along the way for the SIP. When the SN (13) triggers the terminated call to the CU (11) with SIP INVITE message, these parameters added in the nodes such as SBC, P-CSCF (44), or A-SBC are used in the CU (11). In other words, the SNs (13) directly transmits the parameters added by the source node in any previous IN (12) or the ON (10) to the CU (11). So that, the CU (11) determines the Type Code and Operator Code values of the IRSCs by mapping the values of the received parameters which are used as Inbound Route Information.

In the second method, as depicted in the Fig. 8 and the Fig. 9, all incoming calls coming from the interconnection routes are triggered to the CU (11) in the INs (12) of the ONs (10) to enable the CU (11) to associate the incoming calls to the CSN. Unlike the triggering of the terminated calls of the CSNs, this trigger is a pre-configured trigger setting in the IN (12) of the ONs (10), which triggers the incoming calls coming from the interconnection paths. In other words, there is no variation in the subscription profile of the CSN, depending on the source call.

Although this method causes many unrelated calls to the CU (11) to be triggered, the method also helps the CU (11) to receive an additional trigger for the same terminated call. While the said additional trigger is received from the IN (12) where the terminated call enters the ON (10), the normal trigger is triggered from the IN (13) where the terminating services of the CSN are triggered in non-mobile networks. In this case, the CU (11) determines an IRSC value for the additional trigger received from the IN (12) and an IRSC value for the trigger received from the SN (13). The CU (11) maps them with the CSN to enable the assessment of the interconnection fraud. The trigger settings in the IN (12) for the INAP protocol are pre-configured to add a dedicated Service Key for each dedicated incoming interconnection route. Alternative methods can be used due to the flexibility of SIP. In the first method for SIP, an Operator Identifier is defined for each national and international interconnection route in the SIP unit configurations related to the interconnect partners, by using the routing configurations of the SBC or the IN (12). The Operator Identifier is a parameter area defined in the protocol standards of SIP. A security key is defined in the SBC and the CU (11), taking into account possible interference from the fraudsters. According to this, the SBC adds the Operator Identifier into the received-realm parameter in the Via header of the INVITE message. If the CU (11) receives a SIP INVITE with a received- realm parameter in one of the Via headers and it indicates a predefined value for any Inbound Route Information, then said Operator Identifier value is used as the Inbound Route Information related to the trigger. In addition, as a safety precaution before using this parameter, the CU (11) makes sure that the JSON (JavaScript Object Notation) JWS (Web Signature) data has the same parameters as the received INVITE message. This ensures that the Operator Identifier value is received from an SBC of the ON (10). In the second method for SIP, the CU (11) uses the FQDN, or IP addresses related to the interconnection routes of the interconnection partners, this information is automatically added into the Via header when the SIP INVITE message enters in the ON (10). If the CU (11) detects a pre-configured FQDN or IP address that indicates a predefined value related to any Inbound Route Information, then the Inbound Route Information is determined.

The S-CSCF nodes in the IMS network indicate whether the INVITE message belongs to an originating or terminated call to the Application Services. Nevertheless, for a general solution to IMS and non-IMS networks that support SIP, the SIP units in the ON (10) can be configured to use the Operator Identifier setting, or the CU (11) can use the IP addresses in the Via header to detect the originating calls in the ON (10). In the Network Originated Fraud, the fraudsters make international calls from the ON (10) to the international foreign numbers. The CSNs of these calls can be the CSNs of the triggers received from the SUs (21) which CSNs can also be received as international foreign numbers. Or the CSNs can be roaming subscriber numbers which are called by the test calls generated by the CU (11). The ON (10) is configured to trigger all originating international calls to the CU (11) for detecting the Network Originated Fraud, thus the CU (11) associates the triggers of these originating international calls with the CSNs of the source calls. This trigger configuration is statically configured in the ON (10) and is not based on the CSN, therefore there is no variation in the subscription profile of the CSN of the source call. If the called numbers have international number prefixes, the ON (10) is triggered according to these called number digits. In IMS networks, this configuration can also be pre-configured as a general Application Service to all subscribers, so that the CU (11) is triggered for international called numbers according to the Telephony URI parameter in the To header of the INVITE message. Similarly, as with the triggers of terminated calls of the CSN, the CU (11) firstly associates these received triggers to the CSNs by using the Called Party Number of the IDP message or the Telephony URI parameter of the INVITE message. Then, the CU (11) determines one or more IRSC values for the triggers related to the prefix of the called number and maps the IRSC values to the CSNs it controls.

About the determination of IRSC through the associated network CDRs of the terminated calls

In another embodiment of the present invention, the CU (11) uses the CDRs of the ONs (10) to determine the one or more IRSC values of the terminated call. The IRSCs of the terminated calls are determined using associated network CDRs of the CSN. The said associated network CDRs are obtained from a process of the ON (10). This process can be fed from the charging system or signaling monitoring system of the ON (10). The initiation time stamp and the CSN of the said source call are sent to this process as association parameters. This process returns a list including associated network CDRs. Every row in this list includes the parameters of the associated network CDRs in columns.

If the terminated call of the source call reaches ON (10), at least one associated network CDR will remain in this list. In addition, for example, if the call enters from an IN (12) and is terminated at an SN (13), there would be more than one associated network CDR for one terminated call. The reason for this is that the IN (12) and the SN (13) will generate the CDRs related to the same terminated call. Similarly, the CU (11) will determine two IRSCs for this call and each IRSC is for each generated associated network CDR. The first of these will indicate a Type Code of National or International value. The second of these will indicate a Type Code value of Internally Terminated.

The Inbound Route Name and Calling Party Number parameters from each associated network CDR remaining in this list are extracted in order to determine the IRSC value of each associated network CDR. The CU (11) determines the Type Code and Operator Code values of this IRSC from this Inbound Route Name parameter using a pre configured mapping. This Inbound Route Name corresponds to the Inbound Route Information. This is because the Inbound Route Name uniquely defines an interconnection route and indicates the interconnection partner from which the call is received. The CU (11) defines the operator that has the subscription of the Calling Party Number by conducting a NP query for the Calling Party Number. The Operator Information value of the IRSC is assigned as the Operator Code value of the operator having the said subscription. According to the definition of IRSC in the present invention, the CU (11) assigns a dedicated Operator Code value for each national operator of the country of the ON (10). If the source call is a generated test call of the CU (11), the CU (11) needs to prevent the test calls from ringing the CSNs in order to obtain the IRSCs from the associated network CDRs without using the triggers of the terminated calls from the ON (10). However, in the case where the source calls are triggered from the SUs (21), the CU (11) can use the method of the associated network CDRs without having to prevent terminated calls from ringing the CSNs. The reason for this is that, unlike the test calls, the source calls have to connect to the CSNs. Therefore, a CFU variation is performed to the subscription profile of the CSN throughout the control of the test call of the CSN. This is performed because the control of the CSN is based on the CDR analysis, not triggers, therefore in the other case, the CU (11) would not be able to hold the terminated calls.

The CFU is used to control the terminated calls of the CSN. The CFU definition is made if the CSN is a local subscriber number and the said local subscriber number is an active subscriber number of a real subscriber of the ON (10). The CFU setting forwards the terminated calls of the CSNs to a test number throughout the control of the CSN. The test call is transmitted to CU (11) by the ON (10). The CFU setting of the CSN is retrieved after the completion of the control of the CSN. When a terminated call of the CSN is forwarded to the CU (11), unlike the trigger method, there is no need for managing by signaling only, but the carrier of the call also needs to be managed by the CU (ll).

The CU (11) may detect the interconnection fraud with a delay, depending on the delay in the CDR infrastructure of the operator. For example, the CU (11) reports terminated calls to interconnection partners as the CNI Fraud, because the CU (11) has no trigger communication to stop the detected terminated calls in real-time. Therefore, reporting the terminated call later is not important. Similarly, since there is no need for real-time action throughout the terminated call in the Network Terminated Fraud and Network Originated Fraud, the Detected Fraud Numbers can be blocked even if they are detected after the associated network CDRs of the CSN is received. As for the test calls, if there is a delay in the process of the CDR, the CU (11) terminates the test call in real-time at the end of the predefined period normally according to a method of detecting the probable coinciding subscriber calls. Thus, receiving the associated network CDRs with a delay will not affect the CU (11) process, except for the late detection of the interconnection fraud.

About detection and prevention of interconnection fraud

As soon as an IRSC is mapped with the CSN, the CU (11) performs the analysis of the said IRSC in real-time throughout the control of the CSN. The Fig. 10 shows the flow chart of a method of analyzing each determined IRSC of the CSN. The CU (11) controls whether the IRSC has a Type Code value indicating the value of “Internally Originated” at the start of the flow chart. If the answer is “Yes”, this means that the terminated call of the IRSC is received as originating call in the ON (10) and shows a Network Originated Fraud or Network Terminated Fraud. In the next step, if the CSN of the terminated call is an international foreign number, the CU (11) detects the CNI of the terminated call as Network Originated Fraud. This international foreign number may be a roaming subscriber number related to a generated test call or an international foreign number related to a source call triggered from a SU (21). In this case, the terminated calls to the international foreign numbers are the ON (10) originated international calls. On the other hand, if the CSN is a local subscriber number of the ON (10), then the CU (11) detects the terminated call of the IRSC as the Network Terminated Fraud Inside the Network. And the CNI of the terminated call is detected as Network Terminated Fraud Number Inside the Network. This local subscriber number is a national real subscriber number of the ON (10). In this case, the terminated calls that make a call to the said local subscriber numbers are the ON (10) originated national calls.

At the beginning of the flowchart, if the IRSC does not have a Type Code indicating “Internally Originated”, but the Type Code of the IRSC indicates “International” or “National”, then this means that the terminated call of the IRSC is received via the interconnection routes of the ON (10). If the Type Code of the IRSC indicates “International”, then this means that the terminated call is received via an international interconnection route. In some countries, such as the countries of the European Union, the interconnection fee of the terminated calls is determined according to the originating country of the calls. And the origin of these international calls is determined according to the CNIs of the terminated calls. For this reason, if a lower interconnection fee is applied to the CNI of the terminated call of the IRSC than the original CNI of the source call, then the CU (11) detects this terminated call as CNI Fraud from International Interconnection. In this fraud scenario, the fraudsters manipulate or distort the CNI of the international calls as if they were originating from a country with lower interconnection fees. If a lower interconnection fee is not applied to the CNI of the terminated call of the IRSC than the original CNI of the source call, then the CU (11) detects this terminated call is not an interconnection fraud.

On the other hand, if the Type Code of the IRSC indicates “National”, then this means that the terminated call of the IRSC is received via a national interconnection route. In the next step, the CU (11) compares the Operator Code and Operator Information values of the IRSC. The Operator Code of the IRSC indicates the interconnection partner or the operator network in which the terminated call is received via the national interconnection route. The Operator Information indicates the operator network in the country having the CNI currently as a subscriber in the terminated call of the IRSC, or in other words the Operator Code. If the Operator Code and Operator Information values of the IRSC are equal, then the CU (11) detects the terminated call as Network Terminated Fraud Outside the Network, and the CNI of the terminated call is detected as Network Terminated Fraud Number Outside the Network. For example, the fraudsters can assign the CNIs to the subscriber numbers of other national networks in the country. If the CU (11) had not been comparing the Operator Information and Operator Code of the IRSC, these manipulated CNIs would have failed in detecting the Fraud Numbers.

In addition, if the Operator Code and Operator Information of the IRSC are different, the CU (11) detects the terminated call as the CNI Fraud from National Interconnection. In this type of fraud, the CU (11) detects the fraudster’s attempts to terminate the source call via a national interconnection route instead of an international interconnection route. The reason for this fraud is that operators in many countries all around the world charge higher termination fees for terminating international calls than for national calls. Therefore, the fraudsters prefer to terminate via national routes instead of paying higher termination fees via international interconnections. As in the previous example, if the fraudster hides the CNI and manipulates the CNI to a national number of other operators, then the CU (11) detects the terminated call as the CNI Fraud from a National Interconnection.

In addition, the interconnection partner the ON (10) may have a license to carry transit traffic in the country, this means that they receive calls from other networks and carry them to other networks as carriers. The terminated calls of the interconnection partners include different CNIs depending on which network they carry traffic from. However, if an interconnection partner does not have a license, this also means the detection of traffic transport without the license. For example, aside from the specific scenarios of the call forwarding, a national mobile operator terminates the calls to the ON (10) with the CNIs that are normally subscriber numbers thereof. Therefore, if the terminated call is detected as a CNI Fraud from National Interconnection and the interconnection partner that terminates the call does not have a license to carry transit traffic in the country, the CU (11) generates an information alert for the operator. In this case, the operator can report this to the interconnection partner to enable them to control if there is a problem, then they can report to the regulatory authority in their country in case of a possible infringement of the regulation on this issue.

The Network Originated Fraud Numbers, the Network Terminated Fraud Inside the Network Numbers, and the Network Terminated Fraud Outside the Network Numbers are kept in the CU (11) as Detected Fraud Numbers. The detected interconnection fraud is prevented by blocking the calls of the Detected Fraud Numbers. The probability of receiving a coinciding subscriber call that corresponds to the CSN during the control of the CU (11) is of significance. Scientifically, it is a rather negligible probability for a normal subscriber to make calls such that they coincide with the different CSNs of the CNIs and the control time of the CSNs. Therefore, the CU (11) blocks the Detected Fraud Numbers after a predefined number of repetitive Detected Fraud Numbers are detected. This eliminates the probability of blocking the normal subscriber numbers in practice. The operator can wait for the Detected Fraud Numbers to be detected again a predefined number of times, depending on the willingness of the operator to avoid risk. The ON (10) may select the risk level by adjusting the predefined number. For example, the operator can adjust this predefined number to two in order to block the CNI after it is detected as a Detected Fraud Number for the second time.

According to the method, the CU (11) adds the Detected Fraud Number into a list. The CU (11) automatically deletes each Detected Fraud Number in the list after a predefined period from its entry to the said list. This predefined time starts again when each Detected Fraud Number is detected again. A blocking flag is activated for Detected Fraud Number in the list, if the Detected Fraud Number is detected as a configurable number of successively Detected Fraud Numbers, during the time it is active in the list. When the blocking flag is determined for a Detected Fraud Number in the list, the CU (11) automatically starts preventing the Detected Fraud Number.

The CU (11) activates the feature of blocking outgoing and incoming calls for these Detected Fraud Numbers with an active blocking flag in the list over the subscription interface of the ON (10) if the ON (10) has a subscription of the Detected Fraud Number. The operator makes the interconnection partners block the detected numbers of the Network Terminated Fraud Inside the Network that have the subscriptions. In addition, the operator can block the incoming calls with the numbers of the Network Terminated Fraud Outside the Network from the incoming calls from the interconnection partners since the speed of blocking is highly important for the operators not losing the revenue. The incoming calls received from the national interconnection routes are triggered to the CU (11) in the ON (10) to block the detected numbers of the Network Terminated Fraud Outside the Network, wherein if the CNI of the trigger which is related to one of the incoming calls is a Detected Fraud Number with an active blocking flag in the list, then the CU (11) blocks the incoming call of the trigger.

At this point, this predefined time may be of importance for keeping a number on the list. For example, if a Detected Fraud Number is purchased by a normal subscriber of a national operator within a time period after the number is detected as a fraud number, the CU (11) keeps blocking the incoming calls from the same number. However, if the Detected Fraud Number is deleted from the list after the predefined time period is expired, the CU (11) does not block the incoming calls. Therefore, no problem occurs in using legally of the CNIs by normal subscribers. Meanwhile, the predefined time period should be kept lower than the time, in which the CNI is sold by the national operators to a new subscriber after terminating the old subscription in the country.

The interconnection fraud may be prevented by automatically blocking the terminated calls detected as CNI Fraud by the CU (11). The CU (11) also reports the terminated calls detected as the CNI Fraud to the interconnection partners to enable them to clear the inbound traffic from the CNI Fraud. When the terminated calls related to the generated test calls are detected as CNI Fraud from International Interconnection or CNI Fraud from National Interconnection, the said test calls have evidential value for interconnection infringement for the interconnection partners. In practice, the interconnection partner can use the records to resolve the issue with previous carriers. However, in most cases this causes a high amount of time and energy cost to achieve a result and there may be no permanent solution to be obtained.

Although the test calls provide valuable data, the source calls triggered from the SUs (21) as the real calls of the FNs (22) provide a deterrent and permanent solution against the CNI Fraud. The reason for this is if the terminated calls of the CSN are triggered to the CU (11), the CU (11) can block the real calls detected as CNI Fraud during the control of the CSN in real-time. This capability completely resolves the said types of fraud for the FNs (22) in which the real calls can be triggered to the CU (11). Thus, the previous carriers or even the interconnection partners have to stop carrying manipulative traffic from these FNs (22) in a short time, because the previous carriers retrieved the traffic due to failed calls.

If the terminated call is triggered from the ON (10), then the CU (11) may terminate the terminated call over the trigger communication of the terminated call. Before terminating the terminated call based on the detection of the CNI Fraud, the CU (11) needs to extract the coinciding subscriber calls for preventing the calls from blocking. The reason for this is that in the CNI Fraud there is no CNI that can be repetitively detected, as in the Network Originated Fraud and Network Terminated Fraud. According to this, if a sequential (consecutive) message of the source call indicates a ringing or answering related to the source call, and if no ringing or answering is received corresponds to the terminated call of the CSN within a predefined number of seconds, then this means that the CU (11) detects the terminated call of the CSN as a coinciding subscriber number. Therefore, the CU (11) does not block the detected coinciding subscriber number. As an alternative to blocking the real calls, the operator can set off the interconnection payment at the end of the payment period, if they have agreed accordingly in the contract with the interconnection partners. For example, this method may be used if the terminated calls of the source calls are determined with the associated network CDRs. The operator shares a report of the CU (11) with the interconnection partners which includes the supporting CDR details, if necessary, in order to realize this, and the interconnection payments can be adjusted accordingly. Similar to determining the subscriber calls before automatically blocking, the CU (11) is configured to report to the interconnection partners excluding the coinciding subscriber calls. This can cause detecting and filtering some terminated calls as subscriber calls depending on the fraudsters manipulating the times of the call events. Therefore, as an alternative, the CU (11) can report all of the terminated calls of an interconnection partner without filtering detected coinciding subscriber calls, however, if the amount of the terminated call is higher than a predefined rate of the total incoming calls from the interconnection partners this report is conducted. This means that the fail rate of the coinciding subscriber calls is reduced to a negligible level since there is a sufficiently high amount of manipulative traffic from the interconnection partner.

In the CNI Fraud from International Interconnection, the terminated call without the CNI should be subject to the action in the CU (11). Since the CNI Fraud from International Interconnection occurs in countries where the interconnection fee of the termination is implemented based on the CNIs received for the terminated calls, the operators in these countries should either block the terminated calls without the CNI or charge a standard higher price. According to the policy of the operator, the CU (11) can be configured to block terminated calls without the CNI if the real calls are received as terminated calls that have the International Type Code value of IRSC.

About the analysis of the coinciding subscriber numbers and faulty answers in test calls

In the prior art, the establishment of the coinciding normal subscriber calls fails throughout the control of the test calls generated to the CSNs. The coinciding subscriber calls are the normal subscriber calls that are made to the CSN throughout the control thereof. This is a problem of the prior art that particularly renders the method of generating test calls impractical in the customer-focused markets, in which the customer experience is as important as the loss of revenue due to interconnection fraud. In addition, when the CU (11) presumably chooses the terminated call so as to answer it as a terminated call related to a test call, there is a risk of answering a coinciding subscriber number instead of the test call desired to be answered. The present invention solves a huge part of failed calls and faulty answers. Although a probability still remains regarding said risk in the present invention, this probability has been reduced to a very low level compared to the prior art.

In the first part of the solution, if the terminated call is detected as Network Terminated Fraud or Network Originated Fraud, then the CU (11) firstly terminates the test call. The CU (11) carries on any terminated call which is on hold to connect to the CSN at the end of a predefined period after the termination. If this terminated call had belonged to a test call indeed, then the test call would not have rung the telephone of the CSN, since the test call is terminated. In accordance with that, if this terminated call had been a coinciding subscriber call, then it would have been successfully connected to the CSN. This protects the coinciding subscriber calls from failing when the terminated calls are detected as Network Terminated Fraud or Network Originated Fraud. The CU (11) can implement this method by the triggers of the terminated calls of the CSN or forwarded calls of the terminated calls of the CSN.

In addition, when the terminated call is not detected as Network Terminated Fraud or Network Originated Fraud, the problem is a little bit more complex. In this case, the terminated calls are coming from the interconnection routes related to the interconnection partners, and the Operator Code and Operator Information of the IRSC related to the terminated call are of different values. In other words, the terminated calls are detected either as normal termination or CNI Fraud. Therefore, besides the necessity of recovering the probable coinciding subscriber numbers, the CU (11) has to answer some of the terminated calls as a precaution against the problem of alternative routing. In addition, the CU (11) should also keep the number of answers to a minimum due to its cost to the operator.

In the alternative routing, some of the fraudsters terminate international calls primarily through legal international routes of the operators, due to attempts of the operators to prevent interconnection fraud. After the called number rings or even after CSN answers that, they hold the incoming call on one hand, and cut off the terminated part of the call on the other hand and establish the call as Network Terminated Fraud call via the FUs (30) or CNI Fraud call via normal interconnections.

In the prior art, since the test calls are received from the legal interconnections and it is not possible to detect whether the calls are terminated calls related to test calls or coinciding subscriber calls, problems occur. According to the prior art, one option is to answer the terminated call as a precaution against the alternative routing. So that the operator can detect the alternative routing attempt after that. However, this leads to a risk of answering a coinciding subscriber call. As an alternative option, the test call can be terminated, so that any possible coinciding subscriber call does not have to meet a failure. Therefore, the terminated call is carried on connecting to the CSN. However, this leads fraudsters to get over the test call. Finally, there may be an option for the said test call to be carried on connecting to the CSN, which is in fact not even an option, because in this case the real subscribers are disturbed since their CSN are ringing or their CSNs are being connected. In addition, in an embodiment of the present invention, the alternative routing of the fraudsters does not affect the source calls that are triggered from the SUs (21) as the real calls of the FNs (22). The reason for this is that the majority of these calls ring normally or are answered by their CSNs. Therefore, in the next attempt to establish a call related to the re-establishment of the call as the interconnection fraud, the CU (11) will detect the interconnection fraud.

In the present invention disclosed, a method of adaptive answering is implemented to the terminated calls of the CSN, in which the problem of alternative routing is solved if the source calls are the test calls. This method requires real-time control and intervention on the terminated calls of the CSN. The CU (11) can implement this method by the triggers of the terminated calls of the CSN or the forwarded calls of the terminated calls of the CSN. In this way, the CU (11) may connect the terminated calls to the CSN if they are detected as the coinciding subscriber calls or answer these calls.

In Network Terminated Fraud and Network Originated Fraud, even if the fraudsters terminated only a single international call in the ON (10), the CU (11) detects the CNIs of the originating calls as the Detected Fraud Number. Therefore, there is no point in answering these calls or implementing the method of adaptive answering to these calls. It is expected that the attempt of alternative routing is received over normal international interconnection routes. Since the fraudster can use legal interconnection routes for terminated calls, this method is mainly implemented if the terminated call is not detected as an interconnection fraud. In this case, the Type Code of the IRSC related to the terminated call is International. In addition, the fraudsters can attempt alternative routing with lower interconnection costs, considering the cost of calls that are answered by the CSNs. Therefore, terminated calls that are detected as CNI Fraud from International Interconnection or CNI Fraud from National Interconnection are included in this method even though they are detected as interconnection fraud.

According to the method, there are two main conditions controlled by the CU (11) through the control of AN. As soon as one of the conditions is fulfilled during the control, the CU (11) implements the method related to this condition. The first main condition is to control whether any of the terminated calls are received with the original CNI of the test call after the initiation of the test call in the CU (11). Receiving a terminated call having the same CNI as the generated test call proves that the terminated call belongs to the test call. Therefore, other terminated calls are detected as coinciding subscriber calls and connected to their CSNs during the control of the CSN. The other terminated calls can be calls on hold by the CU (11) before the terminated call with the original CNI reaches. Else, these other terminated calls may be incoming terminated calls throughout the control. The CU (11) makes sure that other terminated calls do not have an original CNI related to the test call. This means that the CU (11) can overcome the alternative routing of the fraudsters by answering the terminated call related to the test call without risking the coinciding subscriber calls.

The CU (11), either terminates or answers the terminated call with an original CNI. The answering of the test calls incurs a cost to the ON (10). When the test call is directly generated by the CU (11), a cost is incurred since the cost of the outgoing international call is higher than the revenue obtained from the terminated call. Similarly, the cost of answering the test call generated by the TCGS (31) will be probably higher than the revenue of the terminated call. Thus, a predefined answering rate is configured for each FNO related to the test calls in order to be able to control the number of answers. According to this, the CU (11) answers the terminated call if the rate of the answered test calls is lower than the predefined answering rate related to the FNO of the test call. The CU (11) calculates the rate of answered calls by counting the number of generated test calls and the number of answered test calls based on each FNO. Although it is not normally expected, if there is an additional received terminated call with the original CNI throughout the control of the CSN, then the CU (11) implements the same method for each terminated call received in this way.

The second main condition is to control whether any of the terminated calls are received with the original CNI related to said test call throughout at least one predefined time period after the initiation of the test call. The CU (11) waits for a terminated call having the original CNI throughout the predefined time period. If the CU (11) detects that there is no terminated call having the original CNI at the end of a predefined timeout period, then the CU (11) decides to carry on with any other terminated call received with a different CNI. Therefore, the CU (11) firstly controls if there is a terminated call received with a different CNI during said predefined time period in order to be able to carry on with that call. If no terminated call is currently received, then the CU (11) waits for a terminated call having a different CNI or the original CNI during the control of the CSN. When the incoming terminated call has the original CNI, the CU (11) implements the previous method.

When the incoming terminated call is received with a different CNI, the CU (11) either terminates or answers the terminated call according to the instantaneous value of an Adaptive Answering Flag. This Adaptive Answering Flag is set to a binary value which can take True or False values by the CU (11) for each pair of the FNO and Operator Code according to this method. The Operator Code belongs to the IRSC of the terminated call which is received with a different CNI. The Operator Code indicates the interconnection partner from which this terminated call is received. In this way, the method is implemented to traffic groups on the pair of different FNO and Operator Code. In other words, if the fraudster implements the alternative routing for an originating traffic from a FNO and if the attempts are terminated over a certain interconnection partner, then the CU (11) prevents using the method for the test calls which comes from the same FNO but received from the other interconnection partners.

If the value of the Adaptive Answer Flag is False for any pair, then the CU (11) terminates the test call and waits for a predefined timeout period to expire. If the terminated calls are not terminated until the predefined timeout expires, then the terminated calls are detected as coinciding subscriber calls and are connected to the CSN by the CU (11). The reason for this is that the terminated calls are received with a CNI different from the original CNI of the test call. Therefore, the CU (11) cannot risk answering a probable coinciding subscriber call. In another case, if the terminated calls are terminated until this timeout expires, then the CU (11) increases the Termination Counter value related to this pair by one. The Termination Counter counts the termination events of these calls, wherein the test calls of the terminations are assumed to be received from a different CNI other than the pair of the FNO and Operator Code, and these calls are not detected as coinciding subscriber calls. Adaptive Answering Flag is set over a calculation based on the Termination Counter. Thus, the amount of this type of termination helps the CU (11) to decide whether to answer the terminated call. In addition to an attempt at the alternative routing of a fraudster, an attempt of termination can also be a normal call that is received via the legal interconnection route. Considering the fact that many of the calls that are received via legal international interconnection routes can have the original CNI, the counted terminations are more likely to indicate a probable attempt of alternative routing that comes from the pair of FNO-Operator Code.

The CU (11) sets the value of the Adaptive Answering Flag by calculating a Termination Rate and an Answering Rate for each pair of the FNO and Operator Code. These counters and the calculated values are kept independently of other pairs of the FNO-Operator Code. The FNOs are grouped based on the interconnection partners thanks to these pairs, whereby the CU (11) can focus its behavior of adaptive answering on certain interconnection partners in which the fraudsters attempt alternative routing, especially for the traffic received from a FNO. This feature eliminates the risk of faulty answers given to test calls that are received via interconnection partners, said test calls come from a certain FNO but are not used by the fraudster for the alternative routing.

The CU (11) keeps a Termination Counter, a Test Call Counter, and an Answering Counter based on each pair of the FNO-Operator. The values of a Termination Counter, a Test Call Counter, and an Answering Counter are reset if the Termination Counter is not increased throughout a predefined time, or if a pre-configured time is passed since the last reset of the Termination Counter. This is done for guaranteeing that the CU (11) will not answer if there is currently no termination from any pair. The Test Call Counter counts the test calls generated by the CU (11) from each pair. The Answering Counter counts the test calls answered by the CU (11) from each pair. The Termination Rate and the Answering Rate are calculated if the result of the Test Call Counter is higher than a predefined number. The Termination Rate is calculated by dividing the Termination Counter by the Test Call Counter. The Answering Rate is calculated by dividing the Answering Counter by the Test Call Counter.

The CU (11) keeps the value of the Adaptive Answering Flag as True as long as this Termination Rate is higher than a predefined threshold. This threshold value is pre- configured for the FNO. Similarly, the CU (11) keeps the value of the Adaptive Answering Flag as False as long as Answering Rate is higher than a pre-configured predefined threshold value for the FNO. Answering Rate has a priority over Termination Rate in determining - Adaptive Answering Flag value. This means that the CU (11) will not answer a terminated call related to the test call as long as the Answering Rate is calculated higher than the threshold value even if the requirement is met for the Termination Counter. According to this, if the value of the Adaptive Answering Flag has the value as True for the pair related to the terminated call, then the CU (11) answers the terminated call for a random period between a pre-configured minimum and maximum value. The value of the Termination Counter for a pair is increased by one, if the CU (11) detects an establishment of bidirectional connection for the test call that is answered. In the other case, the value of the Termination Counter is decreased by one if the CU (11) does not detect an establishment of a bidirectional connection for the answered call. Due to this detection of faulty answers to a probable coinciding subscriber call since a bidirectional connection is not established the CU (11) decreases the value of the Termination Counter in order not to encourage the answers to the next terminated calls from the same pair. Randomly selected records of the phone conversations are played for the calls that are answered. The CU (11) plays the calling party of this record on the originating part of the test call and the CU (11) plays the called party of this record on the terminated part of the call. These records are updated with new records over time. These precautions are taken to give natural answers as if they were real subscribers.

Thanks to the implementation of these methods, firstly the CU (11) protects the coinciding subscriber calls from failure. Secondly, the CU (11) provides a solution against the alternative routing of the fraudsters by minimizing the risk of faulty answering to probable coinciding subscriber calls.

About Embodiments of the System

A CU system is configured to implement the methods of the present invention relating to the functions of the CU (11). The CU system is configured to use the call information of the source calls and to control the CSN of each source call throughout the source call. The CU System is configured to control the terminated calls of the CSN. This CSN is a real subscriber number. The CU System is configured to determine at least one IRSC for each terminated call and map the determined IRSCs to the CSN throughout the control of the CSN. The CU System is configured to analyze the determined IRSCs of the CSN as well as to detect and prevent the CNI Fraud from International Interconnection, CNI Fraud from National Interconnection, Network Originated Fraud, Network Terminated Fraud Inside the Network and Network Terminated Fraud Outside the Network. The CU system is configured to generate the source calls as the test calls that make calls to the real subscriber numbers as the CSNs. The CU system directly generates the test calls using signaling and carrying protocols. The CU system transmits the test call directly to International Traffic Carriers (25) or via an ON (10). The CU (11) system also is adapted to use TCGSs (31). The TCGS (31) is configured to generate source calls as the test calls, using test probes, robots, or calling services all over the world. The TCGS (31) receives requests for initiating or terminating the test calls from the CU system and sends the ringing, answering, and termination information of the test calls to the CU system.

The CU (11) can be configured as a CU system that operates software modules of the CU (11) on redundant server hardware or in a cloud medium. In the present invention, the CU system also referred to as Local CU System can communicate with the ON (10) such that it is positioned locally in the country of the operator or within the cloud of the ON (10). In addition to providing services solely to the ON (10) as a Local CU system, regulatory bodies of the countries or the operators in the countries can together operate and position a Local CU System that provides service to the local national operators of the country. In this operation model, the Local CU system communicates with the national ONs (10). Local CU system is triggered from the SUs (21) for the real calls. The control of the CSN and prevention of interconnection fraud are performed by the local CU System that provides services locally to ON (10) or the ONs (10) of the country.

The SU (21) alternatively can be implemented as a SU system. The SU system is configured to trigger the call information of the source calls to the CU system as triggers. In an embodiment of the system, the SU (21) can be implemented as the source of the triggers in the present network systems of the FNs (22). FNs (22) are configured to trigger a CDU system or directly the CUs (11) of the ONs (10). The said FNs (22) are all over the world and the source calls are originating international calls of these FNs (22).

In a second preferred embodiment of the SU (21), the SUs (21) can be implemented as the CU systems of countries other than the country of the ON (10). The source calls are originating international calls of the ON (10) of the CU systems that belong to other countries. The ONs (10) of the other countries are configured to trigger all originating international calls to their CU systems. In this way, operators and service providers offering services to prevent fraud may share triggers between the CUs (11) from different countries according to mutual agreements between operators and service providers.

In a third preferred embodiment of the SU (21), the SUs (21) again can be implemented as the CU systems of countries other than the country of the ON (10). However, the source calls obtained from the CU systems of the other countries also comprise all source calls of the CU system. The source calls comprise not only the real calls of the ON (10) of the other countries but also the test calls of the CU systems thereof. Since the test calls of the other CU systems make a call to the Roaming Subscriber Numbers, collecting the triggers of the calls increases the variation of the test calls without bearing the responsibility of controlling the incoming calls towards the called numbers, wherein the CU systems of the other countries fulfill the responsibility.

In a fourth preferred embodiment of the SU (21), the SU (21) may be triggered from any third-party service, network, or TCGS (31), which TCGS (31) may generate the test calls for a purpose other than fraud prevention. The CU (11) in the ON (10) may use the call information of the test calls for detecting Network Originated Fraud. For example, the SUs (21) may be any TCGS (31), which TCGS (31) generates the test calls from FNs (22) all over the world to real subscriber numbers of the other countries.

The CDU (24) may be implemented as a CDU system. The CDU system is configured to provide a central communication between the CU systems of the ONs (10) and the SUs (21) all over the world and receives the triggers of the source calls from the SUs (21) and triggers the said source calls to the CU systems of the ONs (10). Similar to the CU system, the CDU (24) can be configured as a CDU system that operates software modules of the CDU (24) on redundant server hardware or in a cloud medium. The one or more redundant CDU systems may geographically include the triggers of the SUs (21) received all over the world. The CU system is configured to receive the triggers of the real calls from at least one CDU system. While the CDU system can operate as an independent CDU system, it can also operate in combination with the CU system. This combined system acts both as a CDU system and a CU system. For example, if there is only one CU system in the first stage of the worldwide implementation, the CDU system can cooperate with the CU system as a combined system, wherein the CDU system and the CU system cooperate as software modules in the same hardware platform or the virtual platform.

The CU system may be a central CU system that provides services to the operators located in a central position in a different country. The central CU system controls the CSNs and provides services to prevent interconnection fraud for the ONs (10) from different countries. As in the local CU system, the central CU system is also triggered from the SUs (21) for the source calls. The central CU system can receive the triggers from the CDU system. Alternatively, for example in the first stage of the implementation, if there is only one central CU system, the CDU system can cooperate with the central CU system on the same system, wherein the central CDU system and the central CU system can cooperate as interactive software modules. The central CU system centrally generates the source calls as test calls for the operators. The central CU system communicates with the ONs (10) using International Signaling Carriers (23), VPN connections, or secure internet (27) connections.

The functions of the CU system can be divided or distributed into central and local functions. When the network security requirements and the efficiency of the whole system are taken into consideration, the CU system can be configured as a central CU system or as a cooperation of the local CU systems of one or more operators. The local CU system can be configured to provide service for only on the ON (10) locally or for one or more national ON (10) of the country locally. In addition, the Central CU system can be positioned such that it provides service to one or more local CU systems in a central position. The local CU system is configured to control the CSNs and detect and prevent interconnection fraud. On the other hand, the central CU system can be configured to receive the triggers of the source calls from the SUs (21) or CDU systems and to forward the same to the local CU systems. The central CU system is configured to generate source calls as the test calls for the local CU systems. The central CU system receives the information of the test calls to be generated from the local CU system. The central CU system communicates events of ringing, answering, or termination of the test calls to the local CU system. The information of the test calls comprises the CSNs, CNIs, and FNOs related to the test calls.

Industrial Applicability of the Invention The interconnection fraud leads to significant loss of revenue and tax in an increasing trend to the telecommunication operators and by extension, governments. In addition, the uninspected technical infrastructure of the fraudsters exposes clients to important problems of service quality. As a result, operators seek for inclusive, consistent, and deterrent solutions against fraudsters.

Claims

1. A method for preventing interconnection fraud in a telecommunication ON (10); characterized in that

- a CU (11) uses the call information of source calls;

- the CU (11) controls the CSN (Called Subscriber Number) of each source call throughout each source call and the CU (11) controls the terminated calls of the CSN and the CSN is a real subscriber number;

- at least one IRSC (Inbound Route Source Code) is determined for each terminated call throughout the control of the CSN and the CU (11) maps the determined IRSCs to the CSN; and

- the CNI (Calling Number Information) Fraud from International Interconnection, CNI Fraud form National Interconnection, Network Originated Fraud, Network Terminated Fraud Inside the Network and/or Network Terminated Fraud Outside the Network are detected and prevented by analyzing the determined IRSCs of the CSN.

2. A method according to Claim 1; wherein the call information related to the source calls is triggered as triggers from the SUs (21) to the CUs (11) and also characterized in that

- the SUs (21) are the FNs (22) all over the world and the source calls are originating international calls of the FNs (22); or

- the SUs (21) are the CUs (11) of the countries other than the country of the ON (10), the source calls are the real calls that are originating international calls of the ONs (10) of the CUs (11) which belong to other countries and the ONs (10) of other countries are configured such that they trigger all originating international calls to their CUs (11); or - the SUs (21) are the CUs (11) of the countries other than the country of the ON (10), source calls are the said source calls of the CU (11) of the other countries; or

- the SUs (21) are any TCGS (31) that generates the test calls from FNs (22) all over the world to real subscriber numbers of the countries, other than the country of the ON (10).

3. A method according to Claim 2; characterized in that the SUs (21) trigger the said source calls to at least one CDU (24) and the CDU (24) triggers source calls to the CUs (11) of the ONs (10).

4. A method according to Claim 2 or 3; wherein thesaid trigger is a communication related to the call information and characterized in that in the said trigger:

- the communication is realized between the SUs (21) and the CUs (11) via a dedicated block chain network; the said call information is triggered from the SU

(21) to the CU (11) according to an intelligent contract, the ON (10) of the SU (21) and the ON (10) of the CU (11) come to an agreement with one another on the terms of the intelligent contract; or

- the communication comprises sending an initial message or sending an initial message and at least one sequential (consecutive) message, the initial message of the trigger comprises the said call information, the call information comprises the CSN, CNI, the country code of the FN (22) of the source call, the operator code of the FN

(22) of the source call, the initiation time stamp of the initial message and/or time zone of this time stamp, the trigger comprises the call information of the sequential (consecutive) message, the call information comprises at least one or more ring notifications of the CSN, answering notifications of the said source call and/or termination notifications of said source call; or

- the communication is an INAP (Intelligent Network Application Protocol) or CAMEL (Customized Applications for Mobile network Enhanced Logic) signaling protocol, an initial message of the trigger is sent to SCCP (Signaling Connection and Control Part) GT (Global Title) address of the SCF (Service Control Function), said SCF is the CU (11) or the CDU (24) and the said initial message is an IDP (Initial Detection Point) message; or

- the communication is a SIP (Session Initiation Protocol), an initial message of the trigger is sent to an Application Server Name of an Application Service, the Application Server Name defines the CU (11) or the CDU (24), and the said initial message is the INVITE; or

- the communication is the SRI (Send Routing Information) dialog of the MAP (Mobile Application Part) protocol, an initial message of the trigger is sent to a SCCP GT address and the said SCCP GT address is the CSN and the said initial message is a MAP SRI message.

5. A method according to Claim 2 or 3; characterized in that, when the source calls have the CSNs that have country code related to the country of the ON (10), in the transmission method of the triggers:

- the CDU (24) or the SU (21) triggers the source calls to each CU (11) of the ONs

(10) of a country by using multiple triggers; or

- the CDU (24) or the SU (21) triggers the source calls to each CU (11) of a country, the CSNs of the source calls are the number area codes of the ON (10) of each CU

(11), each CU (11) cannot receive the triggers related to these source calls which belong to the subscriber numbers whose CSNs are ported-in, each CU (11) starts the control of CSN if the subscription of the CSN belongs to its ON (10) as a result of the NP (Number Portability) query it conducts for the CSN; or

- the CDU (24) or the SU (21) triggers the Leading CU (11) of a Leading ON (10) for said source calls which have the CSN having the country code of the country, except for the source calls which have the CSN having one of the number area codes of the ONs (10) of other CUs (11) of this country, the other CUs (11) are triggered for the number area codes of their ONs (10) when the Leading CU (11) and other said CUs (11) detect a ported-out subscription for these CSNs according to the answers of the NP queries which is to be conducted for the CSNs of the triggers they receive, they transmit the said initial messages related to these triggers they received to the CUs (11) of the ONs (10) which have the subscriptions of these CSNs; or

- the CDU (24) or the SU (21) triggers a Central STF (33) in a country for the source calls, this Central STF (33) conducts the NP query for the CSNs of said triggers it received and transmits the initial messages of the triggers to the CUs (11) of the ONs (10) which have the subscriptions of the CSNs; or

- the CDU (24) or the SU (21) transmits the triggers to the CUs (11) of the ONs (10) which are mobile type networks having the subscriptions of the CSNs by performing a MAP SRI-SM (Send Routing Information for - Short Message) process for the CSNs, the answers of the SRI-SM process indicate the ONs (10) which have the subscriptions of these CSNs in a country; or

- the CDU (24) or the SU (21) transmits the triggers to the CUs (11) of the ONs (10) having the subscriptions of the CSNs by conducting a NP query from a NP database (32) for the CSN and a country or an operator of the country have access to the said NP Database (32); or

- the CDU (24) or the SU (21) transmits the triggers to the CUs (11) of the ONs (10) having the subscriptions of the CSNs by conducting an ENUM (E. 164 Number to URI Mapping) query for the CSN, the ENUM query is conducted to obtain an URI (Uniform Resource Identifier) related to the ON (10) having the said subscription.

6. A method according to Claim 2 or 3; characterized in that the CDU (24) or the SUs (21) triggers the source calls to the CU (11) for detecting the Network Originated Fraud, the triggers have the international foreign numbers as their CSN, the international foreign numbers have country codes different from the country codes related to the country of the ON (10), the number sequences of the international foreign numbers are selected to be triggered by the ON (10) of the CU (11) and a predefined rate of the triggers are filtered by the CU (11), the CDU (24) and/or the SU (21).

7. A method according to Claim 2; wherein the CU (11) adaptively processes the said source calls of the SUs (21) as the interconnection fraud is detected based on the pair of the SU (21) and FND (Foreign Network Destination) and also characterized in that

- the CU (11) determines the daily total number of the source calls that should be processed as triggers from the SUs (21) and distributes the number into the predefined equal time periods of a day, the distribution is performed proportionally to the average number of the triggers received in the relevant time periods during this day of the week; the distributed value of this total number is divided into TUQ (Trigger Unit Quota) values proportional to the number of the triggers received from each pair of the SU (21) and FND for each time period, and the TUQ values are recorded as predefined TUQs, the TUQs are the number of the said source call to be processed from each pair of the SU (21) and FND for each time period; and

- the CU (11) adaptively determines a new TUQ for each pair of the SU (21) and FND in each new time period, the CU (11) adaptively increases TUQ which is determined for the previous time period by a predefined rate, if at least one of the said source calls is detected as interconnection fraud during the previous time period, and the CU (11) adaptively decreases TUQ which is determined for the previous time period by a predefined rate, if none of the said source calls is detected as interconnection fraud during the previous time period, this TUQ adaptively determined in the said time period, is able to vary between two values determined by a predefined minimum and maximum ratios of the said predefined TUQ of the pair of the SU (21) and FND.

8. A method according to Claim 1; characterized in that the source calls are the test calls generated by the CU (11) and these test calls make a call to the real subscriber numbers as the CSN, the CU (11) selects a FNO (Foreign Network Origin) for this test call and a CNI among the real subscriber numbers such that it corresponds to selected FNO, the selected FNO indicates a selected FN (22) and the selected CNI has a number from the numbering plan of this selected FN (22).

9. A method according to Claim 8;, characterized in that the CU (11) generates the test calls by means of a TCGS (31), and this TCGS (31) generates the test calls from the selected FNOs, the CU (11) communicates the request of initiating and terminating these test calls to TCGS (31), and TCGS (31) communicates the information of ringing, answering, and terminating of the test calls to the CU (11).

10. A method according to Claim 8; characterized in that the CU (11) generates the test calls directly, the CU (11) or the ON (10) transmits the test calls as outgoing international calls to one or more Selected Carriers (40) and the Selected Carrier (40) transmits the test calls it received to the selected Subsequent Carriers (41), the

Selected Carrier (40) keeps a list of FNOs related to each Subsequent Carrier (41), and the said list indicates from which FNOs each Subsequent Carrier (41) carries traffic, the Selected Carrier (40) selects said Subsequent Carriers (41) if they include the FNO of this test call in the said list, the Selected Carrier (40) selects the Subsequent Carriers (41) proportional to the traffic they carry from the FNO of the test call if there are a plurality of Subsequent Carriers (41) that can be selected.

11. A method according to the Claim 9 or 10; characterized in that in generating test calls also

- the said CSNs of the test calls are selected from the local subscriber numbers and the local subscriber numbers are active subscriber numbers of the real subscribers of the ON (10); or - the MAP RN (Provide Roaming Number) messages coming from the IRPNs (36) are transmitted through the CU (11) in the ON (10); the CSNs of the test calls are selected from the roaming subscriber numbers which are in active international roaming in the ON (10), and which are the subscriber numbers of the real subscribers of the IRPNs (36) of the ON (10) for detecting the Network Originated Fraud, the CU (11) terminates the test call upon receiving a MAP PRN message to the roaming subscriber number; and the CU (11) carries on the received MAP PRN message to the ON (10).

12. A method according to Claim 8; characterized in that the CU (11) directly generates the said test calls to the subscriber numbers related to the test SIM (Subscriber Identity Module) cards of the IRPNs (36) of the ON (10), the CU (11) performs a location update for each test SIM card, the subscriber number is selected in accordance with the said selected FNO and said FNO is the network of the selected subscriber number, in generating the test calls also:

- the CU (11) returns a MSRN (Mobile Subscriber Roaming Number) parameter mapped to a selected local subscriber number in reply to a MAP PRN message it received related to this test call, and the local subscriber number is an active real subscriber number of a real subscriber of the ON (10); or

- the ON (10) is configured to transmit the MAP PRN messages to the CU (11), the MAP PRN messages come from the IRPNs (36) of the ON (10); the CU (11) returns a MSRN parameter mapped to a selected Roaming Subscriber Number in reply to the MAP PRN message it received related to the test call, the Roaming Subscriber Number is a real subscriber number of a real subscriber of an IRPN (36) of the ON (10) and performs active international roaming in the ON (10) and the selected Roaming Subscriber Number is selected from a country other than the country of the IRPN (36), in which the selected subscriber number is selected; the CU (11) terminates the test call upon receiving a MAP PRN message to the Roaming Subscriber Number and then the CU (11) carries on received MAP PRN message to the ON (10).

13. A method according to Claim 8; wherein the test calls are generated adaptively on the basis of the said FNO, according to detection of interconnection fraud in order to accelerate the prevention of the interconnection fraud and also characterized in that:

- the CU (11) determines a daily total number of the test calls to generate the same and distributes this number into predefined equal time periods of the day such that it is proportional to the incoming international traffic data received in the ON (10); it also determines a FNQ (Foreign Network Quota) for each FNO for each time period, the predefined FNQ value is the number of the test calls to be generated from each FNO for each time period, proportionally to the daily traffic received from said FNOs included in the said international traffic data; and

- the CU (11) adaptively determines a new FNQ for each FNO in each new time period, the CU (11) increases this FNQ of the previous time period, which is determined adaptively, by a predefined rate, if at least one of the said test calls is detected as interconnection fraud during the previous time period; and similarly the CU (11) decreases the same by a predefined rate if none interconnection fraud is detected during the previous time period, the adaptively determined FNQ value for said time period, may take a value between a predefined minimum and maximum ratios of predefined FNQ value of the said time period.

14. A method according to Claim 8; characterized in that a CFU (Call Forwarding Unconditional) variation is performed which forwards the incoming calls of the CSN to a test number in the subscription profile of the CSN as forwarded calls, the said CFU variation of the CSN is retrieved when the said control of the CSN is completed and the test call is transmitted to the CU (11) in the ON (10) and terminated in the CU (11), and the CSN is a local subscriber number which is an active real subscriber number of a real subscriber of the ON (10), the CU (11) associates these forwarded calls with the CSN, the forwarding party number of the forwarded calls are uses as association parameter with this CSN.

15. A method according to any one of the Claims 1, 2, 8; wherein the IRSC includes a Type Code, an Operator Code, and an Operator Information and characterized in that also

- the value of the Type Code takes the value of International if the terminated call is received via an international interconnection route, National if the terminated call is received via a national interconnection route, Internally Originated if the terminated call is an originating call in the ON (10), Internally Terminated as the absence value when the Type Code does not take a value or if the terminated call is received via other types of internal routes;

- each interconnection partner of the ON (10) and each national operator in the country of the ON (10) is assigned a dedicated code value, the Operator Code is a dedicated code value that is assigned to the interconnection partner from which the terminated call is received in the ON (10);

- the Operator Information is the said Operator Code related to the operator having the subscription of the CNI of the terminated call, the operator having the subscription is either any interconnection partner of the ON (10) or any said national operator in the country of the ON (10), the CU (11) determines the operator having the subscription by conducting a NP query for the CNI.

16. A method according to Claim 15; characterized in that the CU (11) receives triggers from the ON (10), the CU (11) determines the said terminated calls of this CSN by associating these triggers to the said CSN, the triggers are used as association parameter of the called party numbers, at least one IRSC is determined for each associated trigger, the CU (11) maps the determined IRSCs with this CSN and also - the trigger carries at least one Inbound Route Information; the Inbound Route Information is a dedicated code value that is assigned for each inbound route of different types in the ON (10), the Inbound Route Information of the said terminated calls are pre-configured in the trigger configurations of the ON (10) and added to these triggers as a parameter; the Inbound Route Information determines the Type Code or said Operator Code values of the IRSC; the CU (11) determines the Type Code, or this Operator Code values from the Inbound Route Information by using a pre-configured mapping; and

- the said trigger carries the CNI.

17. A method according to Claim 16; characterized in that the triggers related to the terminated calls are provided to the CU (11) via a variation in the subscription profile of the CSN, this variation is retrieved upon the completion of the said control of the CSN, the CSN is a local subscriber number which is an active real subscriber number of a real subscriber of the ON (10) and during the triggers of the terminated calls also

- the CU (11) is triggered as an Application Service with the SIP, this variation in the subscriber profile includes a definition of an Application Service; the Inbound Route Information is the Operator Identifier values carried in the received-realm parameter in the Via header of the SIP INVITE message, or the Inbound Route Information are FQDNs (Fully Qualified Domain Name) or IP (Internet Protocol) addresses carried in Via header of the SIP INVITE message; the said CNI of the terminated call is carried in the Telephony URI parameter inside the From header in the SIP INVITE message and the called party number is carried in the Telephony URI parameter inside the To header in the SIP INVITE message; the variation in the subscriber profile includes a DH (Default Handling) parameter, and the DH value takes a value that means mandatory for the said source calls generated as said test calls and takes a value that means non-mandatory for source calls triggered from the SUs (21); or - the CU (11) is triggered as a SCF by an INAP or CAMEL protocol, the variation of the subscriber profile comprises a TDP (Trigger Detection Point) definition which is for the terminated calls in the INAP, the variation of the subscriber profile comprises a T-CSI (Terminating Camel Service Information) definition which is defined in CAMEL protocol and the HLR (35) of the CSN, the said Inbound Route Information is carried in the Service Key parameter of the IDP message in the INAP and CAMEL protocols, the said CNI of the incoming call is carried in the Calling Party Number parameter of the IDP message and the said calling party number of the incoming call is carried in the Called Party Number parameter of the IDP message, in both INAP and CAMEL protocols, the variation of the subscriber profile comprises a DCH (Default Call Handling) parameter and this DCH value takes a value that means mandatory for the said source calls generated as test calls, and takes a value that means non-mandatory for source calls triggered from the SUs (21).

18. A method according to Claim 17; characterized in that if the ON (10) does not support triggering the terminated calls of the CSN to the CU (11) in the INs (12) or if the ON (10) is a non-mobile network, then the said Inbound Route Information related to the incoming calls received from the interconnection routes or the said Inbound Route Information related to the originating calls of the ON (10) are carried to the SN (13) in at least one parameter area of the call carrying protocol and the ON (10) is configured to add this parameter area into the call carrying protocol and in the triggers of the terminated calls also

- if the triggers of the SN (13) are by an INAP or CAMEL protocol, then the ON (10) adds a number prefix to the calling party number of the call carrying protocol, the trigger configuration of the SN (13) assigns a Service Key value according to the received number prefix corresponds to the carried Inbound Route Information; or - if the triggers of the SN (13) are SIP, the ON (10) adds the Operator Identifier, FQDN, and/or IP address to the INVITE message to be delivered to the SN (13), - the said SN (13) carries the parameter areas directly to the CU (11) in the triggers.

19. A method according to Claim 16; characterized in that if the ON (10) does not support triggering the terminated calls of the CSN to the CU (11) in the INs (12) or if the ON (10) is a non-mobile network, then the INs (12) of the ON (10) is configured to trigger all incoming calls received from the interconnection routes to the CU (11) by signaling.

20. A method according to Claim 16; characterized in that the ON (10) is configured to trigger all originating international calls to the CU (11) by signaling for detecting the Network Originated Fraud.

21. A method according to Claim 14 or 15; wherein the IRSCs of the CSN are determined by the associated network CDRs (Call Detail Record) and characterized in that also

- the associated network CDRs of the CSN are obtained through an ON (10) process, this process is fed from the charging system or signaling monitoring system of the ON (10), the initiation time stamp and the CSN of the source call are sent to this process as association parameters and a predefined time interval starting from the initiation time stamp is used as a time filter by the process, as well as the process returns a list including associated network CDRs and each row in the list comprises parameters of associated network CDR in columns;

- the Inbound Route Name and Calling Party Number parameters are extracted from each associated network CDR;

- the CU (11) determines the Type Code and Operator Code values of the IRSC from the Inbound Route Name parameter using a pre-configured mapping for each associated network CDR and the Inbound Route Name corresponds to Inbound Route Information;

- the CU (11) determines the operator that has the subscription of the Calling Party Number by conducting a NP query for the Calling Party Number for each associated network CDR, assigns the said Operator Information value of the IRSC as the said Operator Code value of the operator having the subscription; and

- each associated network CDR maps the IRSC to the CSN.

22. A method according to Claim 16 or 21; characterized in that if the CSN has any IRSC that indicates Type Code value of Internally Originated and if the CSN is an international foreign number, then the terminated call of the IRSC is detected as Network Originated Fraud, and the CNI related to the terminated call of the IRSC is detected as Network Originated Fraud Number, Network Originated Fraud Number is recorded as Detected Fraud Number.

23. A method according to Claim 16 or 21; characterized in that if the CSN has any IRSC that indicates Type Code value of Internally Originated and if the CSN is a national subscriber number of the ON (10), then the terminated call of the IRSC is detected as Network Terminated Fraud Inside the Network and the CNI related to the terminated call of the IRSC is detected as Network Terminated Fraud Number Inside the Network and Network Terminated Fraud Number Inside the Network is recorded as Detected Fraud Number.

24. A method according to Claim 16 or 21; characterized in that if the CSN has any IRSC that indicates Type Code value of National and if the Operator Information and Operator Code of the IRSC is equal, then the terminated call of the IRSC is detected as Network Terminated Fraud Outside the Network and the CNI related to the terminated call of the IRSC is detected as Network Terminated Fraud Number Outside the Network and Network Terminated Fraud Number Outside the Network is recorded as Detected Fraud Number.

25. A method according to one of the Claims 22 to 24; wherein the Detected Fraud Numbers are blocked to perform interconnection fraud and characterized in that also

- the CU (11) adds the Detected Fraud Number into a list, the CU (11) automatically deletes each Detected Fraud Number in the list after a predefined period from its entry to the list, and the predefined period restarts, if each Detected Fraud Number is detected again; a blocking flag is activated for the Detected Fraud Number in the list, if the Detected Fraud Number is detected as a configurable number of successively Detected Fraud Numbers, during the time it is active in the list;

- the CU (11) activates the feature of blocking outgoing and incoming calls for these Detected Fraud Numbers with an active blocking flag in the list over the subscription interface of the ON (10) if the ON (10) has a subscription of the Detected Fraud Number; and

- incoming calls received from the national interconnection routes are triggered to the CU (11) in the ON (10), if the CNI of the trigger related to one of the incoming calls is a Detected Fraud Number with an active blocking flag in this list, then the CU (11) blocks the incoming call of the trigger.

26. A method according to Claim 16 or 21; characterized in that if the CSN has any IRSC that indicates Type Code value of International, also

- if the ON (10) implements a lower interconnection fee to the CNI of the terminated call of the IRSC than the original CNI of the source call, then the terminated call of the IRSC is detected as CNI Fraud from International Interconnection; and

- if the ON (10) does not implement a lower interconnection fee to the CNI of the said terminated call of the IRSC than the original CNI of the source call, then the terminated call of the IRSC is determined as a normal termination and is not detected as interconnection fraud.

27. A method according to Claim 16 or 21; characterized in that if the CSN has any IRSC that indicates Type Code value of National and if the Operator Information and Operator Code of the IRSC is not equal, then the terminated call of the IRSC is detected as CNI Fraud from National Interconnection.

28. A method according to Claim 26 or 27; characterized in that if the source call related to the terminated call is triggered from the SU (21) and if the IRSC of the terminated call is determined by associated triggers of the CSN, then terminated calls detected as the CNI Fraud from National Interconnection or CNI Fraud from International Interconnection are automatically blocked by the CU (11) and also

- if a sequential (consecutive) message related to the source call indicates a ringing or answering related to the source call, and if a ringing or answering is received that corresponds to the terminated call of the CSN within a predefined number of seconds, then the CU (11) automatically terminates the terminated call upon the said triggering of the terminated call.

29. A method according to any one of the Claims 22 and 24; characterized in that if the source call is a test call and if the terminated call is detected as Network Terminated Fraud or the said Network Originated Fraud the following is also performed to recover the probable coinciding subscriber numbers:

- the CU (11) terminates the test calls;

- the CU (11) carries on any said terminated call which is on hold by the CU (11) to connect with the CSN after a predefined time from this termination.

30. A method according to Claim 26 or 27; characterized in that; if the source calls are test calls, an adaptive answering method is implemented to the terminated call throughout the control of the CSN, if the terminated calls have the IRSC that indicates Type Code value of International, but they are not detected as interconnection fraud and/or the terminated calls are detected as CNI Fraud as well as:

- if any of the terminated calls are received with the original CNI of the test call, then: - other terminated calls without this original CNI are detected as coinciding subscriber calls and connected to the CSNs during the control of the CSN; and

- the CU (11) terminates or answers the terminated call with the original CNI, a predefined answering rate is configured for each FNO of the test calls and the CU (11) answers the terminated call if the rate of the answered test calls is lower than the predefined answering rate related to the FNO of the test call; or

- if none of the terminated calls is received with the original CNI of the test call throughout at least one predefined time period after the initiation of the test call, and if any of the terminated calls are received with a different CNI other than this original CNI throughout the control of the CSN, then:

- if a value of an Adaptive Answering Flag has the False value for the pair of the FNO and Operator Code:

- the CU (11) terminates the test call and waits for a predefined timeout period to expire; - if the terminated calls are not terminated until the timeout expires, then the terminated calls are detected as coinciding subscriber calls and are connected to the CSN by the CU (11); and - if the terminated calls are terminated until the timeout expires, then the CU (11) increases the Termination Counter value related to the said pair by one; or

- if a value of an Adaptive Answering Flag has the True value for the pair of the FNO and Operator Code:

- the CU (11) answers the terminated call for a random period between a pre-configured minimum and maximum value;

- the value of the Termination Counter for said pair is increased by one, if the CU (11) detects an establishment of bidirectional connection for the test call that is answered or it is decreased by one, if the CU (11) does not detect an establishment of bidirectional connection; and

- randomly selected records of the phone conversations are played for the calls that are answered, the CU (11) plays the calling party of this record on the originating part of the test call and the CU (11) plays the called party of this record on the terminated part of the call and updates these records over time.

31. A method according to Claim 30; characterized in that the CU (11) determines the value of the Adaptive Answering Flag by calculating a Termination Rate and an Answering Rate for each pair of the FNO and Operator Code independently of the other pairs, the FNO is the said FNO of the said test call and the Operator Code belongs to the IRSC of the terminated call, and this calculation is performed on each termination or answering of the test call from each pair and also

- the values of a Termination Counter, a Test Call Counter, and an Answering Counter are reset if the Termination Counter is not increased throughout a predefined time, or if a pre-configured time is passed since the last reset of the Termination Counter, the Test Call Counter counts the test calls generated by the CU (11) and the Answering Counter counts the test calls answered by the CU (11);

- the Termination Rate and the Answering Rate are calculated if the Test Call Counter is higher than a predefined number, the Termination Rate is the ratio of the Termination Counter to the Test Call Counter and the Answering Rate is the ratio of the Answering Counter to the Test Call Counter;

- the CU (11) keeps the value of the Adaptive Answering Flag as True as long as Termination Rate is higher than a pre-configured predefined threshold value for the FNO; and

- the CU (11) keeps the value of the Adaptive Answering Flag as False as long as Answering Rate is higher than a pre-configured predefined threshold value for the FNO; and Answering Rate has a priority over the Termination Rate in determining the value of Adaptive Answering Flag.

32. A system for preventing interconnection fraud in a telecommunication ON (10), characterized by a CU system configured to

- use the call information of the source calls;

- control the CSN of each source call throughout the source call, control the terminated calls of the CSN when the CSN is a real subscriber number;

- determine at least one IRSC for each terminated call and map the determined IRSCs to the CSN throughout the control of the CSN and

- analyze the determined IRSCs of the CSN as well as to detect and prevent the CNI Fraud from International Interconnection, CNI Fraud from National Interconnection, Network Originated Fraud, Network Terminated Fraud Inside the Network and/or Network Terminated Fraud Outside the Network.

33. A system according to Claim 32; characterized by the SUs which are configured to trigger the call information of the source calls to the CU system as triggers and also

- the SUs (21) which are the FNs (22) all over the world, wherein the source calls are originating international calls of the FN (22); or

- the SUs (21) which are the CU systems of the countries other than the country of the ON (10), wherein the source calls are originating international calls of the ON (10) of the CU systems which belong to these other countries and wherein the ONs (10) of these other countries are configured such that they trigger all originating international calls to their CU systems; or

- the SUs (21) which are the CU systems of countries other than the country of the ON (10), wherein the source calls are said source calls of the CU systems of other countries; or

- the SUs (21) which may be any TCGS (31) that generates the test calls from FNs (22) all over the world to real subscriber numbers of the countries, other than the country of the ON (10).

34. A system according to Claim 32 or 33; characterized by the CDU (24) which is configured to provide a central communication between the said CU systems of the ONs (10) and the SUs (21) all over the world; and

- to receive the said triggers of the said source calls from the SUs (21) and to trigger the source calls to the said CU systems of the ONs (10).

35. A system according to Claim 32; characterized by the CU system which is configured to generate source calls as the test calls such that they make a call to the real subscriber numbers as the CSNs and configured to generate the said test calls using signaling and carrier protocols to International Traffic Carriers (25) directly or via the ON (10).

36. A system according to Claim 32; characterized by the TCGS (31) which is configured to generate source calls using test probes, robots, and/or calling services all over the world;

- to receive requests from the CU system regarding initiating and terminating the test calls; and

- to send information to the CU system regarding ringing, answering, and/or termination of the test calls.