Detection of a fraudulent call using a neuronal network

The invention relates to a detection of fraud based one belonging to a call from a communication network Billing data set by means of a neural network.

By fraudulent calls, therefore, calls for nothing is paid, arises from the operators Communications networks, such as cellular networks, a significant economic harm.

There are many scenarios for fraud conceivable. On Scenario is for example the unfair selling Call (Call-selling problem) in which calls, typ ically abroad by the fraudster to third low be resold. The affected operators of Communications network never gets but incurred Costs for the sales channeled through the fraudster calls reimbursed because the fraudsters to charging no more is palpable.

Structure, function and operation of neural networks are the Skilled sufficiently known.

In [1] A multilayer perceptron is explained.

The object of the invention is a fraud recognize, based on an unauthorized call, by a fraud by means of a neural network conditional change in the call behavior of a participant is shown.

This object is in accordance with the features of claim 1 dissolved.

A problem is the detection of fraud, of not is obvious, and the operator of the communication network does not really stand on its own. This covert fraud is not immediately recognizable, but must have a certain Time from the observed behavior of a Subscriber of the communication network are determined. tread a striking change in behavior of the participant through a given on time, so can with a certain Probability to a fraudulent call be concluded. For this purpose, for each participant special user profile necessary that the typical Call behavior describes. It's a scam a Deviation from this call behavior.

With each call from a communication network, a fall Accounting record at the different, for the detection fraud useful data contains. As input variables for the neural network used in particular values ​​from the to the current call belonging accounting record and from Accounting records of past calls. On Call a participant's behavior results from the values its accounting records.

An output of the neural network is a measure of indicates that the current call is a fraud. Fraud appears as such, if the output of the neural network exceeds a predetermined value, otherwise the current call is not considered as fraud.

The neural network is preferably before entering the Input variables trained by a set of predetermined Accounting records from which is known whether the each call is a scam or not, into the neural Network are input and accordingly the neural network the predetermined output (fraud or fraud) is trained.

As a development of the invention are input variables for the neural network different values ​​from the Billing records, either individually or in predetermined Combination with one another, the accounting record of current call as well as accounting records find of past calls into account:<sl><li>a) a duration of a national and / or an international call;</li><li>b) numbers of withdrawals made during a predetermined time national and / or international calls;</li><li>c) a cumulative duration of the national and / or international calls;</li><li>d) an average call duration over the specifiable period;</li><li>e) a maximum call duration over the specifiable period;</li><li>f) a variance of the call duration for the predetermined time.</li></sl>

The above-enumerated values ​​are not limiting or to be seen as only to be used values. It Any values ​​from billing records or atomically taking account of contexts, in particular with Accounting records of past calls, combined and are used as input variables for the neural network.

If accounting records of past calls taken into account, then the time period for about be considered past calls statically or dynamically varies within a predetermined range of values will.

The point is that of from a predefined set Input variables to assess the current call as a fraud or not fraud (output) is given.

Another development of the invention is the assign inputs different times of day. A possible subdivision in times of day different day, evening and night.

Furthermore, in the context of an additional development of the Invention, a multilayer perceptron neural network as to use.

Another development of the invention, during a predetermined period of time collect billing records and means of Output of the neural network after the predetermined time period for the accounting records, the to determine the probability that the predetermined in Period a scam was carried out.

A development there, several participants is that a exhibit similar behavior call, in a group summarize and user profile of this group in the neural network to train.

the neural network can also be adapted after training will.

Developments of the invention arise from the dependent claims.

Embodiments of the invention will be based of the drawings and explained.

Show it<dl tsize="6" compact="compact"><dt>Fig.1</dt><dd>a block diagram illustrating steps of a method for Detection of fraudulent call from an includes communication network,</dd><dt>Fig.2</dt><dd>a sketch that the operation of the method indicating the detection of fraudulent call.</dd></dl>

In <u><b>Fig.1</b></u> is shown a block diagram illustrating steps 1a 1d a method for detection of fraudulent Call contains. A call from a communication network, the does not come from a paying subscriber, by means a neural network identified as a scam. there reflects the fraudulent call is not the calling patterns the participant or group of participants with like call behavior. This is from a neuronal Network, with the call behavior of the participant was trained detected.

Each call from the communication network caused a Accounting record, the various values, including<sl><li>a) an identification number of the subscriber;</li><li>b) a duration of the call;</li><li>c) information on whether the call is domestic or goes abroad (distinction: national / international);</li><li>d) a start time of the call.</li></sl>

From these data with each call from the apply communication network, are for a given Period determined cumulative values, including:<sl><li>a) a number of national and international calls;</li><li>b) an absolute time and a relative duration of both the national and international calls;</li><li>c) an average call duration;</li><li>d) a variance of call duration;</li><li>e) a maximum talk time for the given Period.</li></sl>

According to the preset time interval are using this data out statistics for the subscriber, additionally different times (day, evening and Night) are taken into account.

The values ​​described are used as input variables of neural network, by means of which the fraud is detected as a departure from the call behavior of the participant.

In step 1a, the neural network is trained. As for Time exercising accounting records are present, of which it is known that certain combinations of Input variables characterize a fraud and other Combinations of input values ​​indicate no fraud, the neural network is trained monitored, ie the neural network learns predetermined input variables a known output (not fraud or fraud) assigned. The monitored for training the neural Network accounting records used provide appropriate real data is from communications networks, which significantly a scam or no scam mark.

An effective training for the operation of the neural network is roughly defined with equal amounts of billing records to every possible output (ie approximately same number of training data for category 'fraud' as the Category 'not fraud') performed.

The training of the neural network (step 1a) by means of a quasi-Newton optimization algorithm "Weight Decay" [2] carried out. A preferred architecture the neural network is the multilayer perceptron [1].

After training the neural network determined for each Call a number of input variables, which on the Accounting record of the current call and to Accounting records of past calls under Into account a predetermined time period for the Previous chairs of calls based. These input variables in the neural network input (step 1b).

The trained neural network assigns the input quantities a Klassifikationsmaß for the occurrence of fraud to (Step 1c). The fraud is recognized as such, when the Probability above a predetermined limit is. Otherwise, it is an authorized call the rightful participant (from the perspective of the neural network) and there is no fraud appears (see Step 1d).

In <u><b>Fig.2</b></u> the function as the method for detecting fraud represented by a neural network. Each call results in an accounting record ADS, wherein the current outgoing call, a current Accounting record AADs will be created. The data from the Billing records (ADS and AADs) are in a Preprocessing VVA on input variables for the neural EC Network NN ready. The output of the neural network size AG denotes the probability that the current Call corresponds to a fraud. A threshold value EC are the decision ENTG whether the present call an Fraud or not, by the output variable AG, ie the Probability with a predetermined limit (Threshold) is compared and the current call a Fraud is assigned, if the output of the AG the neural network NN is greater than the predeterminable limit, or it is not decided on fraud, if the Output variable AG is smaller than the predetermined barrier.

Bibliography:

<sl><li>[1] DE Rumelhart, GE Hinton and RJ Williams: Learning internal representations by error propagation; Parallel Distributed Processing: Explorations in the Microstructure of Cognition, Vol.1, DE Rumelhart and JL Mcclelland (Eds.), Cambridge, MA: MIT Press, pp.318ff.</li><li>[2] Josef Stoer: Introduction to Numerical Mathematics I, Springer Verlag Berlin, 1983, 4th edition, S.279-281</li></sl>