Identification of a fraudulent call with a neural network

The invention relates to a detection of fraud based one belonging to a call from a communication network Billing data set by means of a neural network.

By fraudulent calls, therefore, calls for nothing is paid, arises from the operators Communications networks, such as cellular networks, a significant economic harm.

There are many scenarios for fraud conceivable. On Scenario is for example the unfair selling Call (Call-selling problem) in which calls, typically abroad, by the fraudster to third low be resold. The affected operators of Communications network never gets but incurred Costs for the sales channeled through the fraudster calls reimbursed because the fraudsters to charging no more is palpable.

Structure, function and operation of neural and causal Networks to those skilled well known.

The object of the invention is a fraud recognize, based on an unauthorized call, by a fraud by means of a neural network conditional change in the call behavior of a participant is shown.

This object is in accordance with the features of claim 1 dissolved.

In general, it should be noted at this point that the neural Network can also be replaced by a causal network.

A problem is the detection of fraud, of not is obvious, and the operator of the communication network does not really stand on its own. This covert fraud is not immediately recognizable, but must have a certain Time from the observed behavior of a Subscriber of the communication network are determined. tread a striking change in behavior of the participant through a given on time, so can with a certain Probability to a fraudulent call be concluded. For this purpose, for each participant special user profile necessary that the typical Call behavior describes. It's a scam a Deviation from this call behavior.

With each call from a communication network, a fall Accounting record at the different, for the detection fraud useful data contains. As input variables for the neural network used in particular values ​​from the to the current call belonging accounting record and from Accounting records of past calls. On Call a participant's behavior results from the values its accounting records.

An output of the neural network are the Probability to that of the current call a constitutes fraud. The fraud is classified as such, if the output of a neural network exceeds predetermined value, otherwise the current Call not constitute fraud.

The neural network is preferably before entering the Input variables trained by a new subscriber initially assigned an average user profile and This user profile is matched by a Probabilistic model, the call behavior of a the participant from billing records describes is created. Finally, the probabilistic model is adapted by the for a predetermined period Inputs from the payroll records for the each participant for training the neural network be used.

As a development of the invention are input variables for the neural network different values ​​from the Billing records, either individually or in predetermined Combination with one another, the accounting record of current call as well as accounting records find of past calls into account:<sl><li>a) a duration of a national and / or an international call;</li><li>b) numbers of withdrawals made during a predetermined time national and / or international calls;</li><li>c) a cumulative duration of the national and / or international calls;</li><li>d) an average call duration over the specifiable period;</li><li>e) a maximum call duration over the specifiable time.</li></sl>

The above-enumerated values ​​are not limiting or to be seen as only to be used values. It Any values ​​from billing records or atomically taking account of contexts, in particular with Accounting records of past calls, combined and are used as input variables for the neural network.

If accounting records of past calls taken into account, then the time period for about be considered past calls statically or dynamically varies within a predetermined range of values will.

The point is that of from a predefined set Input variables to assess the current call as a fraud or not fraud (output) is given.

Another development of the invention is the assign inputs different times of day. A possible subdivision in times of day different day, evening and night.

A next development includes the representation of the Probabilistic model as at least one Gaussian Mixture density which comprises a plurality of Gaussian curves, wherein the can be probabilistic model adapted by respective variances of the individual Gaussian curves accordance with the Input variables are changed for the predetermined period

Further, in the context of an additional development of the Invention, the input variables entered into a causal network, wherein the causal network specifiable fraud scenarios as Expertise, and having a profit or loss which indicates how likely a on the input variables based fraud with at least one of the fraud scenarios match, responsive to the input variables.

There is also a development of the invention in which causal network and the resulting earnings in Related to the output of the neural network to combine to a meaningful overall probability to obtain for the occurrence of fraud.

Another development of the invention, during a predetermined period of time collect billing records and means of Output of the neural network after the predetermined time period for the accounting records, the to determine the probability that the predetermined in Period a scam was carried out.

A development there, several participants is that a exhibit similar behavior call, in a group summarize and user profile of this group in the neural network to train.

the neural network can also be adapted after training will.

Developments of the invention arise from the dependent claims.

Embodiments of the invention will be based of the drawings and explained.

Show it<dl tsize="6" compact="compact"><dt>Fig.1</dt><dd>a block diagram illustrating steps of a method for Detecting a fraudulent call from an includes communication network,</dd><dt>Fig.2</dt><dd>a sketch that the operation of the method for detecting the fraudulent call indicating</dd><dt>Fig.3</dt><dd>a schematic representation of a Gaussian Mixed density</dd><dt>Fig.4</dt><dd>a diagram generally a Fraud probability a definable User profile facing graphically,</dd><dt>Fig.5</dt><dd>a causal network of the description Call response at various Abuse scenarios used,</dd><dt>Fig.6</dt><dd>a causal network, the subscriber model a represents.</dd></dl>

Before the procedure in its entirety on the basis of associated block diagram is illustrated in Figure 1, is a Introduction to the process by means of further figures preferred.

In <u><b>Fig.3</b></u> are individual Gaussian curves G1, G2 and G3 and in this Context, a Gaussian mixture density GMD shown.

The method presented here refers to a neural network which is trained in an unsupervised, ie during the training is no information as necessary (or available), whether the participants considered is a cheater or not. An approach of unsupervised learning is to the density estimate. Using the Gaussian mixture density (Known from [1]) is for each participant in a Communications network based on its past created behavior pattern, a probability model that a typical call behavior of the participant represents. The Gaussian mixture density consists of several Gaussian curves. During the unsupervised learning, carried out by means of the EM algorithm (for details see also [1]) are the free parameters as expected values ​​and Standard deviations of the individual Gaussian curves determined.

Adjustment to subscriber-specific probability models done "online" by adjusting the heights of the individual Gaussian curves. The basis for this "online" Adjustments (Part of the training) are preferably accounting records each participant for a period of last 20 Days.

The resulting after the adjustment probability model for each participant and allows an assessment of the current Call behavior of a subscriber with respect to a potential fraudulent call and it is necessary, ie at Presence a fraudulent call with a predetermined Probability, a warning (alarm) output.

Alternatively, from accounting data for a predeterminable period of time, for example for a day, in a fraudulent call to be closed, with several Participants that show similar behavior call to a Group can be summarized and a user profile (Subscriber model) will be created for this group.

In <u><b>Fig.4</b></u> above is a course K1 a Fraud probability BWK about a timeline TG shown. A neural network, the unsupervised on a predetermined period, here 20 days has been trained, determined after training for the respective subscriber a fraud probability BWK. In the lower part of image 4 is the user profile BPROF, so some predetermined Sizes of this profile, in the form of curves K2, K3 and K4 plotted over time TG. When now a warning to be output depends on the definition of a predetermined threshold value from.

Even after training, the accounting data obtained are used for an adaptation of the neural network. Here, it should be noted that the subscriber in addition to the Model illustrated neural network by a causal network can be.

For detecting a fraudulent call, as above describes the call behavior of a participant by means of neural network trained. Furthermore, it is useful that Knowledge from different abuse scenarios fraudulent calls in the recognition miteinfließen to leave. The more parameters to describe a Call behavior are available, the better the Detection of fraudulent call.

Agent causal networks can be expert for restructure abuse scenarios effectively and according to the structure with (conditional) Probabilities show.

Basis of a causal network is a (directed) graph in the different variables associated with arrows. Each graph represents a class of probability distributions mean represents. arrows within the class approved direct statistically related dependencies.

<u><b>Fig.5</b></u> shows a causal network, which of the description serving call behavior in different abuse scenarios. The call behavior (here: frequencies and mean lengths of calls (see 5c to 5 j) is in the causal network due to the nature of the abuse 5a and 5b the day type). These conditions are expressed by the arrows in Fig.5.

The modeling of the subscriber (subscriber model) is performed by initially an average subscriber model is assigned. This model is specially designed to participants adapted to the particular participant, Accounting records which are submitted by those participants, for used an adaptation of the average subscriber model will. This results in a specific participant model.

An overall assessment of that and of the neural network composed the causal network that combines questions<sl><li>1. Fits the call to the subscriber model?</li><li>2. In the event that the call is a typical Abuse scenario?</li></sl>and thus evaluates the current call under consideration the two questions underlying probabilities a fraudulent call.

In general, therefore, an alarm indicating a fraudulent call signaled displayed when<sl><li>1. a rapid change of the participants' behavior, the does not match the subscriber's profile, appearance, or</li><li>2. a call occurs, the abuse scenario with a predeterminable probability corresponds.</li></sl>

In <u><b>Fig.6</b></u> is another causal network with a Participants model shown Here, to describe the Participants model this causal network as an alternative to the neural network are used. In Figure 6, the Frequency of calls (see 6c to 6f) and the average duration of calls (see 6g to 6j) conditionally by the call behavior (see Figure 6a) and due to the Distinction workday / weekend illustrated (see 6b).

In <u><b>Fig.1</b></u> is shown a block diagram illustrating steps 1a 1f a method for detection of fraudulent Call contains. A neural network NN is unsupervised, so without known from a set of training data, whether a present fraudulent call or not, trained (see Step 1a). After training provides the neural network NN on an input value (call, see Step 1b) in step 1c an output value indicating that the current call with a certain probability in the Subscriber profile fits.

The data of the current call (Step 1b) are also in the causal network KN (step 1e; description, see above) entered, whereby the causal network a Fraud probability outputs.

In an overall evaluation (step 1d), the results are from the neural network NN and the causal network KN combined to form a total probability of fraud for current call, wherein the threshold decision in a Step 1f an alarm for signaling the fraud is or not.

Description will be made on the input data, consisting of the accounting records for each call from the Communication network are obtained:

Each call from the communication network caused a Accounting record, the various values, including<sl><li>a) an identification number of the subscriber;</li><li>b) a duration of the call;</li><li>c) information on whether the call is domestic or goes abroad (distinction: national / international);</li><li>d) a start time of the call.</li></sl>

From these data with each call from the apply communication network, are for a given Period determined cumulative values, including:<sl><li>a) a number of national and international calls;</li><li>b) an absolute time and a relative duration of both the national and international calls;</li><li>c) an average call duration;</li><li>d) a variance of call duration;</li><li>e) a maximum talk time of the period considered.</li></sl>

According to the preset time interval are using this data out statistics for the subscriber, additionally different times (day, evening and Night) are taken into account.

In <u><b>Fig.2</b></u> The operation of the process for detecting of fraud by means of the neural network NN and the causal Network KN shown. Each call results in a Accounting record ADS, said outgoing for the currently Call a current accounting record AADs will be created. The data from the payroll records (ADS and AADs) be in a pre VVA on input variables for EC the neural network NN and the causal network KN ready. The Output Size AG network featuring the combined total probability of fraud, determined by the neural network NN and the causal network KN, for the fact that the current call a fraud corresponds. A threshold value is the EC Decision ENTG whether the present call is a scam or not, by the output variable AG, ie the Probability with a predetermined limit (Threshold) is compared and the current call a Fraud is assigned, if the output of the AG larger than the predeterminable limit is or is not on fraud where, if the output is less than AG the predetermined barrier.

Within this document, the following publication was cited:<sl><li>[1] Prof. Dr. Heinz Rehkugel and Dr. Hand Georg Zimmermann (Editor): Neural Networks in the economy, S.110-117.</li></sl>