Cellular Technical Services Company, Inc.

Polaris Wireless, Inc.

Dmitry Kaplan

David M Stanhope

Evan R Green

Scot Douglas Gordon

Randolph W McKernan

Raul Vera

Howard L Wilburn

Chetan Sharma

Scott D Otterson

Randy McKernan

Wm Gerrit Barrere

An illustrative behavior analysis system and a corresponding method are designed to analyze telecommunications-event records and other relevant records associated with wireless terminals to infer whether a wireless user's pattern of behavior is substantially similar or even identical to the pattern of behavior of another user, possibly a known actor. A pattern of behavior typically comprises call-related and location attributes over a period of time. Accordingly, the illustrative embodiment infers an identity or a substantial similarity as between two seemingly distinct users of wireless terminals, based on: (i) how precisely a candidate's pattern of behavior matches a pre-defined pattern of behavior, and/or (ii) how precisely a candidate's pattern of behavior matches another candidate's pattern of behavior.

Recognizing unknown actors based on wireless behavior

An illustrative geo-temporal analysis system analyzes telecommunications-event records and other records associated with wireless terminals to infer a collaborative relationship between users who do not telecommunicate with each other, based on how precisely a first geo-temporal pattern matches a second geo-temporal pattern. When a collaborative relationship is inferred, the system transmits an indication thereof and a request for an estimated location of the respective wireless terminals.

Inferring relationships based on geo-temporal data other than telecommunications

A system for the authorization of wireless telephone communications establishes two sets of authorized telephone numbers. A first set of authorized telephone numbers are supplied by the customer, and the second set of authorized numbers are derived from customer bills paid by the customer. The system analyzes transmission characteristics from an unauthenticated cellular telephone and attempts to verify its authenticity based on the transmission characteristic by analyzing the transmission characteristic with respect to stored reference waveforms for the authentic wireless telephone. However, the results of this signature analysis if negative may be overridden if the telephone number dialed by the unauthenticated cellular telephone matches a telephone number in either the first or second sets of authorized telephone numbers. The system also includes a technique for modifying the reference waveforms to compensate for changes in the transmission characteristic. The system will only consider the inclusion of transmission characteristics from the present communication if the dialed digits for the present communication match one of the telephone numbers in either the first or second sets of authorized telephone numbers.

System and method for the verification of authentic telephone numbers in

A system and method for collecting reference waveforms from authorized wireless telephones in a wireless telephone network. The collected reference waveforms are used by a fingerprint analyzer to distinguish telephone calls made by the authorized wireless telephone from telephone calls made by an unauthorized wireless telephone. The system maintains a pool of specially designated unassigned telephone numbers and selects one telephone number from the pool at random which is provided to a valid subscriber of an authorized wireless telephone. The randomly selected telephone number is to be called by the valid subscriber using the authorized cellular telephone for the purpose of collecting reference waveforms by the system. A radio frequency (RF) receiver of the system monitors and receives transmission signals from a plurality of wireless telephones. Each transmission signal contains a destination telephone number and an identification of its wireless telephone such as MIN/ESN identifiers. The system selects for purposes of collecting reference waveforms the transmission signal whose destination and wireless telephone identification respectively correspond to the randomly selected destination and the identification of the authorized wireless telephone. This ensures that that particular transmission signal belongs to the authorized wireless telephone of the valid subscriber rather than an unauthorized wireless telephone belonging to a pirate since the pirate has no way of knowing the randomly selected telephone number provided to the valid subscriber. The processor then extracts the reference waveform that represents a transmission characteristic of the authorized wireless telephone and stores the extracted reference waveform in memory for use by the fingerprint analyzer.

Waveform collection for use in wireless telephone identification

A system and method for the detection of fraudulent use of a wireless telephone system includes a fingerprint analyzer that identifies an unauthenticated wireless telephone as authorized or fraudulent based on a fingerprint of the unauthenticated wireless telephone. The system maintains a valid destination list specific for each authorized wireless telephone. Each valid destination list contains destinations considered to be valid for that particular authorized wireless telephone. When an unauthenticated wireless telephone transmits a call request containing a destination, the system classifies the call as valid when the destination is in the valid destination list for the authorized wireless telephone regardless of whether the fingerprint analyzer identifies the unauthenticated wireless telephone as fraudulent. The system may bypass or terminate the fingerprint analysis, or simply ignore the result of the fingerprint analysis by the fingerprint analyzer. The system also maintains an invalid destination list specific for each authorized wireless telephone with destinations considered to be invalid for that particular authorized wireless telephone. Calls to such destinations are blocked. The system further maintains a suspicious destination list containing destinations considered to be potentially fraudulent. When the destination contained in the call request is in the suspicious destination list, the fingerprint analysis is performed with a higher threshold to require a closer match between a fingerprint of the unauthenticated wireless telephone and a stored fingerprint of the corresponding authorized wireless telephone.

Apparatus and method for preventing fraudulent calls in a wireless

A system and method for combining the results of different analysis portions to produce a single YES/NO decision regarding the validity of a present cellular telephone call. A soft data analysis portion of the system analyzes soft data, such as the results of a signature analyzer and a customer call profile and determines the likelihood that the particular call is a valid call from an authorized cellular telephone or an invalid call from a fraudulent cellular telephone. In addition, the system performs a deterministic analysis of the particular phone call to independently designate the particular phone call as valid or invalid. The outputs from the deterministic analyzer and the soft data analyzer portion are combined in a combinatorial logic circuit to produce a single binary output having one logic level for valid calls from the authorized cellular telephone and the opposite logic level for invalid calls from the fraudulent cellular telephone. In addition, the deterministic analyzer may include a control line to override the decision of the soft analyzer to permit calls to designated numbers, such as emergency numbers, even if the independent analysis indicates that the particular call is invalid. In one embodiment, the soft data analyzer portion is a fuzzy logic classifier receiving data inputs and confidence values from the various soft data portions of the system. The fuzzy logic classifier combines the various soft data inputs to produce a single binary output. A sensitivity input is used to vary the threshold of the binary output. The binary output of the fuzzy logic analyzer is combined with the outputs of the deterministic analyzer by the combinatorial logic circuit.

System and method for detection of fraud in a wireless telephone system

A system for the detection of fraudulent use of a wireless telephone system includes a signature analyzer to analyze the transmission characteristic of an unauthenticated transmitter. If the system authenticates the transmitter, based on stored records, the system establishes a customer call profile, based on the geographical location of the wireless telephone at the time of the calls, as well as a time period in which the communication occurs. The system uses these records to establish a customer call profile. The system analyzes a subsequent call and the customer call profile to designate the subsequent call as valid or invalid. The system overrides the decision of the signature analyzer that a particular unauthenticated wireless telephone is fraudulent if the values for call parameters of the subsequent call are sufficiently close to the corresponding parameter values in the customer call profile. The system is adaptive in that old call data records are periodically deleted, thus allowing their replacement with newer call data records.

A system analyzes telephone calls that have been determined by signature analysis to be fraudulent and stores parameter data associated with the fraudulent cell phone. During subsequent cell phone calls, the system compares the stored parameter data associated with the fraudulent cell phone to corresponding parameters from a subsequent call to determine whether the subsequent call is from the fraudulent cellular telephone. In this manner, the system may reject subsequent cellular telephone calls as fraudulent without the need for time consuming signature analysis. Parameters analyzed by the system can include the time of day of the fraudulent call, the origin from which the fraudulent call was placed, the transmitted identification numbers of the fraudulent telephone, and the destination telephone number of the fraudulent call. The system can analyze one or more of these parameters in combination to determine that the subsequent call is fraudulent.

System and method for detection of redial fraud in a cellular telephone

A system and method extracts a portion of a transmitted waveform and compares the transmission characteristics of the extracted waveform to determine if they match a stored fingerprint associated with the transmitter, such as a cellular telephone. The system adaptively creates fingerprint data by storing a plurality of waveforms believed to be from a particular transmitter and calculates the variability of the individual transmissions with respect to a composite mean waveform of the transmission characteristics. The system emphasizes the variability between the individual waveforms and the composite mean waveform and determines variability values for each of the individual waveforms in the fingerprint. When the system receives an additional unidentified transmission purported to be from the transmitter with the stored fingerprint, the system determines whether the variability of the unidentified waveform fits within the predetermined margins of variability for the fingerprint. If the variability of the unidentified waveform is less than a predetermined variability threshold, the system considers the waveforms to be a suitable match. The system can adaptively include new waveforms in the fingerprint by determining whether the newly-received transmission characteristics meet a series of criteria for inclusion in the fingerprint. In addition, the system analyzes the newly-received waveform and all waveforms forming the fingerprint to determine if any of the waveforms exceed a predetermined maximum variability value. A waveform that exceeds the maximum variability value is eliminated from the fingerprint. The system is easily automated, thus providing a useful analysis technique for communications network such as cellular telephone systems where a large population of transmitters with similar transmission characteristics are operating at any given time.

Growing community of inventors

Bellevue, WA, United States of America

Dmitry Kaplan