초록 ▼

A method of, and a system for, detecting possible fraudulent use of a telecommunications network. Call event records, both call initiation and call completion records, are examined. A call record has a number of key fields, e.g. called number, calling number, calling card number, and for each field

A method of, and a system for, detecting possible fraudulent use of a telecommunications network. Call event records, both call initiation and call completion records, are examined. A call record has a number of key fields, e.g. called number, calling number, calling card number, and for each field in turn the key is used to access a database containing an associated set of profiles. Each profile contains an algorithm defining a measurement process to be performed on the call data, e.g. determine the call duration. The respective process results are added to a respective set of stores associated with each profile, and an alarm response is generated when a threshold of a store is reached. An additional process for e.g. a call duration of e.g. called number card calling number key fields, convert the process results to penalty points which are added to a penalty points store associated with the calling card number key of the call event record under examination. Each response is recorded in a history file for that key.

대표청구항 ▼

[ We claim:] [1.] A method of detecting possible fraudulent use of a communications network, which network is arranged to provide call event records having fields containing call event data, at least one of the fields being designated a key field and containing a key relating to an entity as herein

[ We claim:] [1.] A method of detecting possible fraudulent use of a communications network, which network is arranged to provide call event records having fields containing call event data, at least one of the fields being designated a key field and containing a key relating to an entity as herein defined, the method comprising the steps of:reading a first key field of a call event record and obtaining its key;addressing a database by the combination of the first key field and the obtained key (referred to as the "first combination") to access a first combination-associated profile set comprising(i) at least one profile identifying(a) a respective call event data processing algorithm defining a process to be performed upon call event data to obtain a process result,(b) at least one first combination-associated first store to be incremented by the process result, and at least one respective threshold for the or each said first combination-associated first store,(c) a respective predetermined outcome to be generated when the contents of a said first combination-associated first store reaches a threshold, at least one said predetermined outcome comprising a fraud risk indicator,(ii) a further profile identifying(d) a first combination-associated second store to be incremented by a fraud risk indicator,(e) at least one respective threshold for said first combination-associated second store, and(f) a further respective predetermined outcome to be generated when the contents of said first combination-associated second store reaches a threshold;processing the call event data of the call event record in accordance with said first combination-associated profile set, therebyobtaining one or more respective process results,incrementing the corresponding identified first combination-associated first store or stores by the respective process result, and, if a threshold is reached,generating the corresponding respective predetermined outcome, and, if a fraud risk indicator is generated,incrementing said first combination-associated second store by that fraud risk indicator, and, if a threshold is reached,generating the corresponding further respective predetermined outcome.