US6327352B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
System and method for real-time fraud detection within a telecommunications system
Assignee: AT&T Intellectual Property I LP
•
Filing: 1997-02-24
•
Granted: 2001-12-04
•
Expires: 2017-02-24
Abstract
Abstract Real time detection of the fraudulent use of a telecommunications network is accomplished by analyzing data for each call that is occurring within the network. A signal protocol receiver is used to collect signaling protocol for each call that is occurring within the network. The Signaling protocol data is collected, decoded and formatted into call information records (CIRs). The CIRs contain various operator specified parameters for each call that is occurring within the network. The CIRs are compared to operator defined thresholds. If any of the CIRs exceeds the thresholds, an alert is generated. The alerts are stored in a database where the operator can analyze them and take the appropriate corresponding action to resolve the alert. The alerts and the CIRs are archived in a database so that trends of fraudulent use can be detected and prevented. This method of fraud detection provides for the effective analyzation of every call that is occurring within the network. Accordingly, no call go unanalyzed and ideally no fraud goes undetected. Additionally, the method does not impose an additional load on the network switching equipment and therefore results in a better quality of transmissions.
Inventors
- 👤 Judy Lynn Betts
- 👤 Michael Joseph Hatlak
- 👤 Michael Joseph McGuire
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-06 11:47
CPC Classifications
H; H04; H04M; H04M15/00; H04M15/47; H04L; H04L63/00; H04L63/14; H04M3/00; H04M3/22; H04M3/36; H04M2215/00; H04M2215/01; H04M2215/0148; H04M3/2218
Claims Analysis
Total Claims: 18
Claim 1
Independent Claim
88 words
A method for detecting fraudulent access to a telecommunications network comprising a plurality of switches, the method comprising: (a) providing a signal protocol receiver independent from the switches; (b) collecting signaling protocol data for a call from the telecommunications network using the signal protocol receiver; (c) decoding the signaling protocol data; (d) correlating the signaling protocol data into call information records during the duration of the call; and (e) analyzing the call information records during the duration of the call to detect fraudulent use of the telecommunications network.
Claim 2
Independent Claim
88 words
A method for detecting fraudulent access to a telecommunications network comprising a plurality of switches, the method comprising: (a) providing a signal protocol receiver independent from the switches; (b) collecting signaling protocol data for a call from the telecommunications network using the signal protocol receiver; (c) decoding the signaling protocol data; (d) correlating the signaling protocol data into call information records during the duration of the call; and (e) analyzing the call information records during the duration of the call to detect fraudulent use of the telecommunications network.
Claim 3
Dependent Claim
12 words
The method of claim 1 further comprising classifying the call information records.
Claim 4
Dependent Claim
15 words
The method of claim 1 further comprising storing the call information records in a database.
Claim 5
Dependent Claim
16 words
The method of claim 1 wherein (e) comprises comparing the call information records to pre-established thresholds.
Claim 6
Dependent Claim
16 words
The method of claim 1 wherein (e) comprises comparing the call information records to one another.
Claim 7
Dependent Claim
23 words
The method of claim 4 wherein (e) comprises generating an alert when at least one of the call information records exceeds the thresholds.
Claim 8
Dependent Claim
17 words
The method of claim 6 wherein the alert is in the form of audio, visual or remote.
Claim 9
Dependent Claim
34 words
The method of claim 6 wherein (e) comprises storing the alerts and call information records in a database and maintaining data for a predetermined number of days, to facilitate an analysis of fraudulent trends.
Claim 10
Dependent Claim
23 words
The method of claim 1 wherein the signaling protocol data is in-band and is collected at the plurality of switches within the network.
Claim 11
Dependent Claim
25 words
The method of claim 1 wherein the signaling protocol data is out-of-band and is collected from at least one signal transfer point within the network.
Claim 12
Dependent Claim
28 words
The method of claim 1 wherein the call information records contain at least one of the following parameters: originating, terminating, billing type, using duration, aggregate duration, call volume.
Claim 13
Independent Claim
75 words
A system for detecting fraudulent access to a telecommunications network comprising a plurality of switches, the system comprising: a signal protocol receiver, independent from the switches, for collecting signaling protocol data; a decoder for decoding the signaling protocol data and formulating call information records during the duration of the call; and a processor for analyzing the call information records during the duration of the call in order to detect fraudulent use of the telecommunications network.
Claim 14
Independent Claim
75 words
A system for detecting fraudulent access to a telecommunications network comprising a plurality of switches, the system comprising: a signal protocol receiver, independent from the switches, for collecting signaling protocol data; a decoder for decoding the signaling protocol data and formulating call information records during the duration of the call; and a processor for analyzing the call information records during the duration of the call in order to detect fraudulent use of the telecommunications network.
Claim 15
Dependent Claim
32 words
The system of claim 12 wherein the processor comprises a pre-processor for classifying the call information records and a watch point processor for comparing the call information records to operator defined thresholds.
Claim 16
Dependent Claim
26 words
The system of claim 12 wherein the processor further comprises a fraud analysis processor for storing the alerts and the call information records in a database.
Claim 17
Independent Claim
135 words
A method for detecting fraudulent access to a telecommunications network comprising a plurality of switches, the method comprising: (a) providing a signal protocol receiver independent from the switches; (b) collecting signaling protocol data from the network using the signal protocol receiver; (c) decoding the signaling protocol data; (d) correlating the signaling protocol data into call information records containing at least one call parameter during the duration of the call; (e) classifying the call information records based upon the at least one call parameter; (f) analyzing the call information records by comparing them to pre-established thresholds or other call information records during the duration of the call; (g) generating an alert if the call information records exceed the thresholds; (h) storing the alerts in a database; and (i) storing the call information recording in a database.
Claim 18
Independent Claim
135 words
A method for detecting fraudulent access to a telecommunications network comprising a plurality of switches, the method comprising: (a) providing a signal protocol receiver independent from the switches; (b) collecting signaling protocol data from the network using the signal protocol receiver; (c) decoding the signaling protocol data; (d) correlating the signaling protocol data into call information records containing at least one call parameter during the duration of the call; (e) classifying the call information records based upon the at least one call parameter; (f) analyzing the call information records by comparing them to pre-established thresholds or other call information records during the duration of the call; (g) generating an alert if the call information records exceed the thresholds; (h) storing the alerts in a database; and (i) storing the call information recording in a database.
References Cited (Backward Citations)
US4002848A
Cited
US4159400A
Cited
US4188508A
Cited
US4811378A
Cited
US4799255A
Cited
US6185415B1
Cited
US5351290A
Cited
US5345595A
Cited
US5506893A
Cited
US5706338A
Cited
US5602906A
Cited
US5555551A
Cited
US5504810A
Cited
US5465387A
Cited
US5495521A
Cited
US5438570A
Cited
US5463681A
Cited
US5627886A
Cited
US5768354A
Cited
US5729597A
Cited
US5596632A
Cited
US5805686A
Cited
US5937043A
Cited
US5912954A
Cited
US6085084A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2004-12-03 | 2005-06-04 | 2005-12-04 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2008-12-03 | 2009-06-04 | 2009-12-04 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2012-12-03 | 2013-06-04 | 2013-12-04 | $7700.00 | Window Closed / Lapsed |