Apparatus and method for detecting fraudulent telecommunication activity

Claim 1

An apparatus for detecting potentially fraudulent telecommunication activity, comprising: a digital computer; interface means, operating within said digital computer, for receiving a call information record for each call involving a particular subscriber; pattern means, operating within said digital computer, for using a plurality of said call information record for said particular subscriber to identify a subscriber-specific pattern of historical call usage and relative to which deviations from said historical call usage can be detected that may be indicative of fraudulent call activity; comparison means, operating within said digital computer, for comparing the particular subscriber's current call usage with information relating to said subscriber-specific pattern of historical call usage to identify potentially fraudulent call activity; and output means, operating within said digital computer, for outputting an indication of a potentially fraudulent call activity based upon a result of the comparison performed by said comparison means; wherein said information relating to said subscriber-specific pattern of historical call usage includes a subscriber-specific five-day moving average call velocity threshold and said comparison means compares the particular subscriber's current five day moving average call velocity usage with said subscriber-specific five-day moving average call velocity threshold.

Claim 2

An apparatus for detecting potentially fraudulent telecommunication activity, comprising: a digital computer; interface means, operating within said digital computer, for receiving a call information record for each call involving a particular subscriber; pattern means, operating within said digital computer, for using a plurality of said call information record for said particular subscriber to identify a subscriber-specific pattern of historical call usage and relative to which deviations from said historical call usage can be detected that may be indicative of fraudulent call activity; comparison means, operating within said digital computer, for comparing the particular subscriber's current call usage with information relating to said subscriber-specific pattern of historical call usage to identify potentially fraudulent call activity; and output means, operating within said digital computer, for outputting an indication of a potentially fraudulent call activity based upon a result of the comparison performed by said comparison means; wherein said information relating to said subscriber-specific pattern of historical call usage includes a subscriber-specific five-day moving average call velocity threshold and said comparison means compares the particular subscriber's current five day moving average call velocity usage with said subscriber-specific five-day moving average call velocity threshold.

Claim 3

An apparatus for detecting potentially fraudulent telecommunication activity, comprising: a digital computer; interface means, operating within said digital computer, for receiving a call information record for each call involving a particular subscriber; pattern means, operating within said digital computer, for using a plurality of said call information record for said particular subscriber to identify a subscriber-specific pattern of historical call usage and relative to which deviations from said historical call usage can be detected that may be indicative of fraudulent call activity; comparison means, operating within said digital computer, for comparing the particular subscriber's current call usage with information relating to said subscriber-specific pattern of historical call usage to identify potentially fraudulent call activity; and output means, operating within said digital computer, for outputting an indication of a potential fraudulent call activity based upon a result of the comparison performed by said comparison means; wherein said information relating to said subscriber-specific pattern of historical call usage includes a subscriber-specific ten-day moving average call velocity threshold and said comparison means compares the particular subscriber's current ten day moving average call usage with said subscriber-specific ten-day moving average call velocity threshold.

Claim 4

An apparatus for detecting potentially fraudulent telecommunication activity, comprising: a digital computer; interface means, operating within said digital computer, for receiving a call information record for each call involving a particular subscriber; pattern means, operating within said digital computer, for using a plurality of said call information record for said particular subscriber to identify a subscriber-specific pattern of historical call usage and relative to which deviations from said historical call usage can be detected that may be indicative of fraudulent call activity; comparison means, operating within said digital computer, for comparing the particular subscriber's current call usage with information relating to said subscriber-specific pattern of historical call usage to identify potentially fraudulent call activity; and output means, operating within said digital computer, for outputting an indication of a potential fraudulent call activity based upon a result of the comparison performed by said comparison means; wherein said information relating to said subscriber-specific pattern of historical call usage includes a subscriber-specific ten-day moving average call velocity threshold and said comparison means compares the particular subscriber's current ten day moving average call usage with said subscriber-specific ten-day moving average call velocity threshold.

Claim 5

An apparatus for detecting potentially fraudulent telecommunication activity, comprising: a digital computer; interface means, operating within said digital computer, for receiving a call information record for each call involving a particular subscriber; pattern means, operating within said digital computer, for using a plurality of said call information record for said particular subscriber to identify a subscriber-specific pattern of historical call usage and relative to which deviations from said historical call usage can be detected that may be indicative of fraudulent call activity; comparison means, operating within said digital computer, for comparing the particular subscriber's current call usage with information relating to said subscriber-specific pattern of historical call usage to identify potentially fraudulent call activity; and output means, operating within said digital computer, for outputting an indication of a potentially fraudulent call activity based upon a result of the comparison performed by said comparison means; wherein said comparison means compares the particular subscriber's current usage with a combination of at least two of the following of said information relating to said subscriber-specific pattern of historical call usage: a subscriber-specific pattern of historical call duration usage, a subscriber-specific pattern of historical call velocity usage, and a subscriber-specific pattern of historical call velocity usage that includes subscriber-specific call velocity thresholds.

Claim 6

An apparatus for detecting potentially fraudulent telecommunication activity, comprising: a digital computer; interface means, operating within said digital computer, for receiving a call information record for each call involving a particular subscriber; pattern means, operating within said digital computer, for using a plurality of said call information record for said particular subscriber to identify a subscriber-specific pattern of historical call usage and relative to which deviations from said historical call usage can be detected that may be indicative of fraudulent call activity; comparison means, operating within said digital computer, for comparing the particular subscriber's current call usage with information relating to said subscriber-specific pattern of historical call usage to identify potentially fraudulent call activity; and output means, operating within said digital computer, for outputting an indication of a potentially fraudulent call activity based upon a result of the comparison performed by said comparison means; wherein said comparison means compares the particular subscriber's current usage with a combination of at least two of the following of said information relating to said subscriber-specific pattern of historical call usage: a subscriber-specific pattern of historical call duration usage, a subscriber-specific pattern of historical call velocity usage, and a subscriber-specific pattern of historical call velocity usage that includes subscriber-specific call velocity thresholds.

Claim 7

An apparatus for detecting potentially fraudulent telecommunication activity, comprising: a digital computer; interface means, operating within said digital computer, for receiving a call information record for each call involving a particular subscriber; pattern means, operating within said digital computer, for using a plurality of said call information record for said particular subscriber to identify a subscriber-specific pattern of historical call usage and relative to which deviations from said historical call usage can be detected that may be indicative of fraudulent call activity; comparison means, operating within said digital computer, for comparing the particular subscriber's current call usage with information relating to said subscriber-specific pattern of historical call usage to identify potentially fraudulent call activity; and output means, operating within said digital computer, for outputting an indication of a potentially fraudulent call activity based upon a result of the comparison performed by said comparison means; wherein at least one of said current call usage and said information relating to said subscriber-specific pattern of historical call usage includes a plurality of moving averages, and said comparison means performs a comparison using said plurality of moving averages.

Claim 8

An apparatus for detecting potentially fraudulent telecommunication activity, comprising: a digital computer; interface means, operating within said digital computer, for receiving a call information record for each call involving a particular subscriber; pattern means, operating within said digital computer, for using a plurality of said call information record for said particular subscriber to identify a subscriber-specific pattern of historical call usage and relative to which deviations from said historical call usage can be detected that may be indicative of fraudulent call activity; comparison means, operating within said digital computer, for comparing the particular subscriber's current call usage with information relating to said subscriber-specific pattern of historical call usage to identify potentially fraudulent call activity; and output means, operating within said digital computer, for outputting an indication of a potentially fraudulent call activity based upon a result of the comparison performed by said comparison means; wherein at least one of said current call usage and said information relating to said subscriber-specific pattern of historical call usage includes a plurality of moving averages, and said comparison means performs a comparison using said plurality of moving averages.

Claim 9

An apparatus for detecting potentially fraudulent telecommunication activity, comprising: a digital computer; interface means, operating within said digital computer, for receiving a call information record for each call involving a particular subscriber; pattern means, operating within said digital computer, for using a plurality of said call information record for said particular subscriber to identify a subscriber-specific pattern of historical call usage and relative to which deviations from said historical call usage can be detected that may be indicative of fraudulent call activity; comparison means, operating within said digital computer, for comparing the particular subscriber's current call usage with information relating to said subscriber-specific pattern of historical call usage to identify potentially fraudulent call activity; and output means, operating within said digital computer, for outputting an indication of a potentially fraudulent call activity based upon a result of the comparison performed by said comparison means; wherein said current call usage includes a five-day moving average and said information relating to said subscriber-specific pattern of historical call usage includes a ten-day moving average, and said comparison means performs a comparison using said five-day moving average and said ten-day moving average.

Claim 10

An apparatus for detecting potentially fraudulent telecommunication activity, comprising: a digital computer; interface means, operating within said digital computer, for receiving a call information record for each call involving a particular subscriber; pattern means, operating within said digital computer, for using a plurality of said call information record for said particular subscriber to identify a subscriber-specific pattern of historical call usage and relative to which deviations from said historical call usage can be detected that may be indicative of fraudulent call activity; comparison means, operating within said digital computer, for comparing the particular subscriber's current call usage with information relating to said subscriber-specific pattern of historical call usage to identify potentially fraudulent call activity; and output means, operating within said digital computer, for outputting an indication of a potentially fraudulent call activity based upon a result of the comparison performed by said comparison means; wherein said current call usage includes a five-day moving average and said information relating to said subscriber-specific pattern of historical call usage includes a ten-day moving average, and said comparison means performs a comparison using said five-day moving average and said ten-day moving average.

Claim 11

An apparatus for detecting potentially fraudulent telecommunication activity, comprising: a digital computer; interface means, operating within said digital computer, for receiving a call information record for each call involving a particular subscriber; pattern means, operating within said digital computer, for using a plurality of said call information record for said particular subscriber to identify a subscriber-specific pattern of historical call usage and relative to which deviations from said historical call usage can be detected that may be indicative of fraudulent call activity; comparison means, operating within said digital computer, for comparing the particular subscriber's current call usage with information relating to said subscriber-specific pattern of historical call usage to identify potentially fraudulent call activity; and output means, operating within said digital computer, for outputting an indication of a potentially fraudulent call activity based upon a result of the comparison performed by said comparison means; wherein said pattern means further comprises means for characterizing the particular subscriber's current call usage as a first moving average and said subscriber-specific pattern of historical call usage as a second moving average, each calculated over a different specified number of days, wherein said comparison means compares the first moving average to said second moving average to determine if a meaningful increase in usage has occurred.

Claim 12

An apparatus for detecting potentially fraudulent telecommunication activity, comprising: a digital computer; interface means, operating within said digital computer, for receiving a call information record for each call involving a particular subscriber; pattern means, operating within said digital computer, for using a plurality of said call information record for said particular subscriber to identify a subscriber-specific pattern of historical call usage and relative to which deviations from said historical call usage can be detected that may be indicative of fraudulent call activity; comparison means, operating within said digital computer, for comparing the particular subscriber's current call usage with information relating to said subscriber-specific pattern of historical call usage to identify potentially fraudulent call activity; and output means, operating within said digital computer, for outputting an indication of a potentially fraudulent call activity based upon a result of the comparison performed by said comparison means; wherein said pattern means further comprises means for characterizing the particular subscriber's current call usage as a first moving average and said subscriber-specific pattern of historical call usage as a second moving average, each calculated over a different specified number of days, wherein said comparison means compares the first moving average to said second moving average to determine if a meaningful increase in usage has occurred.

Claim 14

An apparatus for detecting potentially fraudulent telecommunication activity, comprising: a digital computer; interface means, operating within said digital computer, for receiving a call information record for each of at least two calls associated with a particular subscriber and derived from a switching center that establishes calls between telecommunication devices; detection means, operating within said digital computer, for detecting an occurrence of overlapped calls using said call information record for each of said at least two calls, said detection of overlapped calls indicating that calls associated with said particular subscriber were placed in an improbable time sequence that is indicative of potentially fraudulent call activity; and output means, operating within said digital computer, for outputting an indication of overlapped calls based upon a result of the analysis performed by said analysis means.

Claim 15

An apparatus for detecting potentially fraudulent telecommunication activity, comprising: a digital computer; interface means, operating within said digital computer, for receiving a call information record for each of at least two calls associated with a particular subscriber and derived from a switching center that establishes calls between telecommunication devices; detection means, operating within said digital computer, for detecting an occurrence of overlapped calls using said call information record for each of said at least two calls, said detection of overlapped calls indicating that calls associated with said particular subscriber were placed in an improbable time sequence that is indicative of potentially fraudulent call activity; and output means, operating within said digital computer, for outputting an indication of overlapped calls based upon a result of the analysis performed by said analysis means.

Claim 20

An apparatus for detection potentially fraudulent telecommunication activity, comprising: a digital computer; interface means, operating within said digital computer, for receiving a call information record for each call involving a particular subscriber; pattern means, operating within said digital computer, for using a plurality of said call information record for said particular subscriber to identify a subscriber-specific pattern of historical call usage and relative to which deviations from said historical call usage can be detected that may be indicative of fraudulent call activity; comparison means, operating within said digital computer, for comparing the particular subscriber's current call usage with information relating to said subscriber-specific pattern of historical call usage to identify potentially fraudulent call activity; and output means, operating within said digital computer, for outputting an indication of a potentially fraudulent call activity based upon a result of the comparison performed by said comparison means; wherein said current call usage includes a first average of call usage over a first period of time extending from a first starting point in time, said information relating to said subscriber-specific pattern of historical call usage includes a second average of call usage, said comparison means compares said first average of call usage to said second average of call usage to determine if said first average of call usage exceeds said second average of call usage and, if so, whether said first average exceeds a third average of call usage relating to said subscriber-specific pattern of historical call usage over a second period of time extending from a second starting point in time by a predetermined amount, wherein said first and second periods of time are substantially equal, but said first starting point in time is different than said second starting point in time.

Claim 21

An apparatus for detection potentially fraudulent telecommunication activity, comprising: a digital computer; interface means, operating within said digital computer, for receiving a call information record for each call involving a particular subscriber; pattern means, operating within said digital computer, for using a plurality of said call information record for said particular subscriber to identify a subscriber-specific pattern of historical call usage and relative to which deviations from said historical call usage can be detected that may be indicative of fraudulent call activity; comparison means, operating within said digital computer, for comparing the particular subscriber's current call usage with information relating to said subscriber-specific pattern of historical call usage to identify potentially fraudulent call activity; and output means, operating within said digital computer, for outputting an indication of a potentially fraudulent call activity based upon a result of the comparison performed by said comparison means; wherein said current call usage includes a first average of call usage over a first period of time extending from a first starting point in time, said information relating to said subscriber-specific pattern of historical call usage includes a second average of call usage, said comparison means compares said first average of call usage to said second average of call usage to determine if said first average of call usage exceeds said second average of call usage and, if so, whether said first average exceeds a third average of call usage relating to said subscriber-specific pattern of historical call usage over a second period of time extending from a second starting point in time by a predetermined amount, wherein said first and second periods of time are substantially equal, but said first starting point in time is different than said second starting point in time.

Claim 22

An apparatus for detecting potentially fraudulent telecommunication activity, comprising: a digital computer; interface means, operating within said digital computer, for receiving a call information record for each call involving a particular subscriber, said call information record derived from a switching center that establishes connections between telecommunication devices; analysis mean, operating within said digital computer, for receiving said call information record from said interface means and using said call information record in analyzing the particular subscriber's call usage to identify potentially fraudulent call activity; and output means, operating within said digital computer, for outputting an indication of said potentially fraudulent call activity; said analysis means includes pattern means for using a plurality of said call information record for said particular subscriber to develop information relating to a subscriber-specific pattern of historical call usage, and means for comparing current call usage of the particular subscriber to said information relating to said subscriber-specific pattern of historical call usage; wherein said current call usage includes a first average of call usage over a first period of time that extends from a first starting point, said information relating to said subscriber-specific pattern of historical call usage includes a second average of call usage, and said comparison means compares said first average of call usage to said second average of call usage to determine if said first average of call usage exceeds said second average of call usage and, if so, whether said first average exceeds a third average of call usage relating to said subscriber-specific pattern of historical call usage that extends over a second period of time extending from a second starting point by a predetermined amount, wherein said first and second periods of time are substantially equal, but said first starting point in time is different from said second starting point in time.

Claim 23

An apparatus for detecting potentially fraudulent telecommunication activity, comprising: a digital computer; interface means, operating within said digital computer, for receiving a call information record for each call involving a particular subscriber, said call information record derived from a switching center that establishes connections between telecommunication devices; analysis mean, operating within said digital computer, for receiving said call information record from said interface means and using said call information record in analyzing the particular subscriber's call usage to identify potentially fraudulent call activity; and output means, operating within said digital computer, for outputting an indication of said potentially fraudulent call activity; said analysis means includes pattern means for using a plurality of said call information record for said particular subscriber to develop information relating to a subscriber-specific pattern of historical call usage, and means for comparing current call usage of the particular subscriber to said information relating to said subscriber-specific pattern of historical call usage; wherein said current call usage includes a first average of call usage over a first period of time that extends from a first starting point, said information relating to said subscriber-specific pattern of historical call usage includes a second average of call usage, and said comparison means compares said first average of call usage to said second average of call usage to determine if said first average of call usage exceeds said second average of call usage and, if so, whether said first average exceeds a third average of call usage relating to said subscriber-specific pattern of historical call usage that extends over a second period of time extending from a second starting point by a predetermined amount, wherein said first and second periods of time are substantially equal, but said first starting point in time is different from said second starting point in time.