Sprint Communications Comapny L.p.

Sprint Spectrum L.p.

Clearwire IP Holdings L.l.c.

Narus, Inc.

Sprint Communication Cômpany L.p.

Travis Edward Dawson

Hui Zang

John Nathan Larson

Kosol Jintaseranee

Mark Evans

Jing Yea

Heesook Choi

Jay Cee Straley

Supranamaya Ranjan

David Lindel Harris

Orin Paul Reams, Iii

David Bannister

Joe Cowan

Robert Edward Esposito

Qiu Jin

Linda Chau

David Shearer Moyle

Ryan Charles McDowell

A wireless communication device that executes applications receives keep-alive messages including keep-alive data from the applications. The device processes the keep-alive data to select keep-alive messages for keep-alive message integration. The wireless communication device transfers integrated keep-alive data for the selected messages during a transfer window. A wireless communication system receives and processes the integrated keep-alive data to transfer individual keep-alive messages having the keep-alive data.

Keep-alive message integration over a wireless communication network

Systems and methods are provided for managing keep-alive messages remote to a wireless communication device. In a particular embodiment, a method provides receiving an application request from a wireless communication device for an application that transfers keep-alive messages and receiving a first keep-alive message from the application intended for delivery to the wireless communication device. The method further provides processing the first keep-alive message to determine whether a response to the keep-alive message is necessary. If a response to the keep alive message is necessary, transferring a keep-alive message response to the application.

Remote keep-alive message management in a wireless communication network

Embodiments disclosed herein provide systems and methods that prevent clone devices from registering with a wireless communication network. In a particular embodiment, a wireless device exchanges communications with a wireless communication network during an initial period of time. The wireless device transfers an initial location of the wireless device during the initial period of time to an authorization system for the wireless communication network. During a second period of time, the wireless device transfers a registration request indicating a confirmation location and a location of the wireless device during the second period of time to the authorization system. The authorization system processes the registration request to validate the confirmation location based on the initial location. If the confirmation location is validated based on the initial location, then the authorization system allows the wireless device to access the wireless communication network during the second period of time.

Preventing clone device registration in a wireless communication system

A centralized security management system (CSMS) is provided to monitor a network to detect and mitigate attacks in or to the network. The CSMS includes a variety of devices located throughout the network to collect and synthesize data collected or obtained from devices operating in the network. The collected data is analyzed using behavioral engines or other software algorithms to develop trends for a normal and abnormal operating condition. The abnormal operating conditions are analyzed further to determine attacks to the devices or the network. Based on the attacks, a mitigation scheme is implemented to remove or reduce the attacks.

Centralized security management system

Generating fraud indications related to communications devices. A fraud metric is calculated for known nonfraudulent users. A fraud metric is calculated for known fraudulent users. An initial value is selected for the threshold. The fraud metric is calculated for a third set of users. The users of the third set are classified as being fraudulent or nonfraudulent according to the threshold. A false positive rate is determined and compared to a maximum false positive rate. When the rate exceeds the maximum, then the threshold is raised and the process is repeated until the false positive rate does not exceed the maximum false positive rate. A false negative rate is determined and compared to a maximum false negative rate. When the false negative rate exceeds the maximum false negative rate, then the threshold is lowered and the process is repeated until the false negative rate does not exceed the maximum.

Telecom fraud detection using social pattern

Subject matter described herein is directed to detecting unauthorized use, such as by a cloned mobile device, of wireless telecommunication services. Differences in location patterns of unauthorized and authorized mobile devices are leveraged to detect likely fraudulent uses. For example, a location-pattern entropy of an authorized mobile device is tracked. A change in the location-pattern entropy suggests an unauthorized use of the mobile device's account.

Telecom-fraud detection using device-location information

Systems, methods, and computer-readable media for eliminating unwanted data packets by a restricted bandwidth network that interfaces with a second network are provided. In embodiments, a device receives unwanted data packets associated with identification of the device. Due to the transient nature of some forms of device identification, data packets intended for one user may be received by another user who has taken on the device identification of the first user. To remedy this situation, unwanted data packets are identified and blocked at a gateway based on the source and/or destination identification associated with the data packets.

Elimination of unwanted packets entering a restricted bandwidth network

A method and system to detect botnet beaconing event based on a beacon detection rule set to generate a beacon alert, which is in turn used to trigger an elevated exfiltration detection activity by reducing various thresholds in an exfiltration detection rule set.

Botnet beacon detection

Embodiments disclosed herein provide systems and methods for packet filtering in a wireless communication network. In a particular embodiment, a wireless network receives from a requesting device a request for a plurality of data packets to be transferred by a source for delivery to the requesting device. The network then generates session information associating the source of the data packets with the requesting device. Additionally, the network receives a first subset of the data packets from the source for delivery to a destination identified by the data packets. After receiving the packets, the network identifies a destination device based on the destination identified by the packets. The network processes the session information to determine whether the destination device is associated with the source of the packets. If the destination device is associated with the source, the network transfers the packets for delivery to the destination device.

Packet filtering by session setup association in a wireless communication system

Subject matter described herein is directed to detecting unauthorized use, such as by a cloned mobile device, of wireless telecommunication services. Mobile-device locations are analyzed to detect outlying locations, such as locations that lack a call relationship with other locations or that are greater than a threshold distance away from other locations. Outlying locations might be detected when more than one discrete location cluster exists among a plurality of mobile-device locations, the discrete clusters having respective locations that are not related by way of a call and that fail to satisfy a threshold distance. Outlying locations or multiple discrete locations clusters suggest an unauthorized use of a mobile device's account.

A method, system, and medium are provided for facilitating a communications call. The method comprises receiving a request to connect to a destination described by a first target which includes a user-identification parameter and a domain parameter. Second, using the target, generating a second target associated with the first target. Finally, permitting the request to be fulfilled if the request is associated with the second target.

Method and system for facilitating packet-based communications

Subject matter described herein is directed to detecting fraud in a telecommunications environment. Communication records of a mobile device include attributes that describe communication instances of the device. For example, communication records might include a start time or end time of voice calls initiated by a mobile device. The attributes are analyzed, such as by calculating call-gap durations, to determine if any thresholds are violated. Threshold violations suggest fraudulent use and prompt an unauthorized-use response.

Using communications records to detect unauthorized use of telecommunication services

A method, system, and medium are provided for detecting fraud, the method comprising: initializing a fraud hypothesis variable associated with a communications device, receiving data that describes a plurality of outgoing communication records that are associated with said communications device, wherein the data is related to activity that took place over a given period of time, extracting a plurality of destination identifiers from said plurality of communication records, for each of at least a portion of said plurality of destination identifiers, modifying said fraud hypothesis variable based on a fraud metric associated with said destination identifier, comparing said fraud hypothesis variable to a first predetermined threshold, and when said fraud hypothesis variable exceeds said first predetermined threshold, generating a fraud indication that is related to said communications device.

Communications-service fraud detection using special social connection

A method, system, and medium are provided for detecting fraud, the method comprising obtaining a plurality of communication records associated with a communications device associated with a user over a fixed period of time, calculating a fraud metric for said records, comparing said metric to a threshold, if said metric exceeds said threshold, generating a fraud alert for said user.

Growing community of inventors

San Francisco, CA, United States of America

Travis Edward Dawson