At&t Intellectual Property I, L.p.

Ana Armenta

Prince Paulraj

Edmond J Abrahamian

Elijah Hall

Andrew Campbell

Surya Murali

Maisam Shahid Wasti

James H Pratt

Lauren Savage

Chih Chien Huang

Jean Luo

Sai Sharath Japa

Brandon Bolong Lee

Ryan Steckel

Anomalies associated with events relating to users or user accounts can be detected. An anomaly detection management component (ADMC) determines embedded arrays comprising data bit groups representative of groups of properties and groups of relationships between properties associated with users, based on analysis of data related to events associated with users. ADMC trains a neural network (NN) based on applying embedded arrays to NN, in accordance with an artificial intelligence (AI) analysis process. ADMC determines an embedded array comprising data bits representative of properties and relationships between properties associated with a user based on analysis of data associated with the user. Trained NN can determine a pattern relating to the properties and relationships associated with the user based on AI-based analysis of the embedded array. Trained NN can detect an anomaly in the pattern based on AI-based analysis of the pattern, wherein the anomaly relates to an event.

Anomaly detection relating to communications using information embedding

A processing system may obtain a request to add at least a first feature to a feature graph database, where the request comprises a first feature ontology of the first feature, and where the first feature ontology comprises: a label of the first feature and a relationship of the first feature to a concept or to another feature. The processing system may then identify whether the first feature is a duplicate of a second feature in the feature graph database based at least upon the first feature ontology and a second feature ontology of the second feature and generate an indication of whether the first feature is a duplicate in response to the identifying.

Disambiguation of feature graph databases

Mitigation of temporal generalization losses a target machine learning model is disclosed. Mitigation can be based on identifying, removing, modifying, transforming, etc., features, explanatory variables, models, etc., that can have an unstable relationship with a target outcome over time. Implementation of a more stable representation can be initiated. Temporal stability measures (TSMs) for one or more model feature(s) can be determined based on one or more variable performance metrics (VPMs). A group of one or more VPMs can be selected based on features of a model in either a development or production environment. Model feature modification can be recommended based on a TSM, which can prune a feature, transform a feature, add a feature, etc. Temporal stability information can be presented, e.g., via a dashboard-type user interface. Models can be updated based on mutations of a model comprising a feature modification(s), including competitive champion/challenger model updating.

Mitigating temporal generalization for a machine learning model

A processing system may obtain a feature vector for a relationship between first and second user identities within a telecommunication network, the feature vector including: a first number of communications from the first user identity to the second user identity for a first communication channel, a first volume associated with the first number of communications, a second number of communications from the second user identity to the first user identity for the first communication channel, and a second volume associated with the second number of communications. The processing system may then calculate a scaled distance between the feature vector and a centroid comprising a mean vector of a set of relationships between user identities within the telecommunication network, where the scaled distance is associated to a trust value, and perform at least one remedial action in the telecommunication network based on the trust value.

Trust labeling of call graphs for telecommunication network activity detection

Aspects of the subject disclosure may include, for example, monitoring a first activity undertaken by a communication device during a first communication session, generating, based on the monitoring, first data that indicates an amount of time that is spent on the first activity, comparing, based on the generating, the first data to a threshold, and identifying, based on at least the comparing, an action to take when the amount of time that is spent on the first activity exceeds the threshold. Other embodiments are disclosed.

Apparatuses and methods for detecting suspicious activities through monitored online behaviors

A processing system may maintain a relationship graph that includes nodes and edges representing phone numbers and device identifiers having associations with the phone numbers. The processing system may obtain an identification of a first phone number or a first device identifier for a fraud evaluation and extract features from the relationship graph associated with at least one of the first phone number or the first device identifier. The plurality of features may include one or more device identifiers associated with the first phone number, or one or more phone numbers associated with the first device identifier. The processing system may then apply the features to a prediction model that is implemented by the processing system and that is configured to output a fraud risk value of the first phone number or the first device identifier and implement at least one remedial action in response to the fraud risk value.

Relationship graphs for telecommunication network fraud detection

Data stream based event sequence anomaly detection for mobility customer fraud analysis is presented herein. A system obtains a sequence of events comprising respective modalities of communication that correspond to a subscriber identity associated with a communication service—the sequence of events having occurred within a defined period. Based on defined classifiers representing respective fraudulent sequences of events, the system determines, via a group of machine learning models corresponding to respective machine learning processes, whether the sequence of events satisfies a defined condition with respect to likelihood of representing a fraudulent sequence of events of the respective fraudulent sequences of events. In response to the sequence of events being determined to satisfy the defined condition, the system sends, via a user interface of the system, a notification indicating that the sequence of events has been determined to represent the fraudulent sequence of events.

Data stream based event sequence anomaly detection for mobility customer fraud analysis

A processing system may maintain a communication graph that includes nodes representing a plurality of phone numbers including a first phone number and edges between the nodes representing a plurality of communications between the plurality of phone numbers and may generate at least one vector via a graph embedding process applied to the communication graph, the at least one vector representing features of at least a portion of the communication graph. The processing system may then apply the at least one vector to a prediction model that is implemented by the processing system and that is configured to predict whether the first phone number is associated with a type of network activity associated with a telecommunication network and may implement a remedial action in response to an output of the prediction model indicating that the first phone number is associated with the type of network activity.

Call graphs for telecommunication network activity detection

A method for detecting threat pathways using sequence graphs includes constructing a sequence graph from a set of data containing information about activities in a telecommunications service provider network, where the sequence graph represents a subset of the activities that occurs as a sequence, providing an embedding of the sequence graph as input to a machine learning model, wherein the machine learning model has been trained to detect when an input embedding of a sequence graph is likely to indicate a threat activity, determining, based on an output of the machine learning model, whether the subset of the activities is indicative of the threat activity, and initiating a remedial action to mitigate the threat activity.

Detecting threat pathways using sequence graphs

A processing system may obtain a customer identifier at a first retail location of a telecommunication network service provider, determine a recency factor of the identifier, obtain an identification of items of interest to the customer, and determine whether the customer has visited a second retail location of the provider within a time period prior to the customer being at the first retail location. The processing system may then apply, to a fraud detection machine learning model, a plurality of factors comprising: a quantity of items of interest, a value of the items, a factor associated with whether the customer has visited the second retail location within the time period, and the recency factor, where the fraud detection machine learning model outputs a fraud indicator value, determine that the fraud indicator value meets a warning threshold and present a warning to a device at the first retail location.

Machine learning telecommunication network service fraud detection

An example method performed by a processing system obtaining a first port-in number for a first mobile device from a first mobile communications service provider, wherein the first port-in number is known to be involved in fraudulent activity, constructing a social graph of communications between the first port-in number and a plurality of other numbers associated with a plurality of other communications devices, identifying, by the processing system, a maximal subgraph of the social graph, wherein the maximal subgraph connects the first port-in number and a subset of the plurality of other numbers that includes those of the plurality of other numbers for which a usage metric is below a predefined threshold for a defined period of time prior to the first port-in number being ported into the first mobile communications service provider, and identifying, by the processing system, a potential fraud ring, based on the maximal subgraph.

Growing community of inventors

San Jose, CA, United States of America

Ana Armenta