Detecting fraudulent SIM card activity while roaming outside a telecommunications network
The present disclosure generally relates to predicting and remediating fraudulent activity associated with a roaming SIM card. Systems described herein involve detecting potential fraud signals associated with a roaming SIM card and applying one or more machine learning models to those signals to generate a fraud prediction. In one or more examples, the potential fraud signals are detected in connection with one or more core network components of a 5G telecommunication network and provide unique insight into the network activities of a user equipment where the roaming SIM card is installed. As such, the systems described herein generate fraud predictions that take into account signals that are not necessarily indicative of fraud by themselves. Once fraud is predicted, the systems described herein execute various remediation actions to correct the fraudulent activities.
1 . In a telecommunication network including one or more subscriber data management functions, a method for detecting fraudulent subscriber identity module (SIM) card usage comprising:
registering a user equipment with the telecommunication network based on one or more interactions with a SIM card installed on the user equipment;
receiving, from a user plane function (UPF) implemented on the telecommunication network, latency data collected by the UPF for communications associated with the user equipment;
detecting a combination of potential fraud signals associated with the SIM card based on a combination of subscriber data received from one or more subscriber data management functions and the latency data collected by the UPF, wherein the subscriber data is obtained when registering the user equipment with the telecommunication network;
applying one or more machine learning models to the combination of potential fraud signals to generate a fraud prediction associated with the SIM card, the fraud prediction being based at least in part on an observed latency from the latency data exceeding an expected latency for the user equipment by a threshold amount, the expected latency being based on the subscriber data; and
executing one or more remediation actions associated with the user equipment based on the fraud prediction.
2 . The method as recited in claim 1 , wherein registering the user equipment with the telecommunication network based on the one or more interactions with the SIM card installed on the user equipment comprises:
receiving a communication from the user equipment comprising a unique identifier stored on the SIM card;
retrieving an authentication key associated with the unique identifier;
generating a random number and a first encryption of the random number utilizing the authentication key;
transmitting the random number to the user equipment;
receiving a second encryption of the random number from the user equipment; and
registering the user equipment based on the first encryption matching the second encryption.
3 . The method as recited in claim 1 , wherein the subscriber data is received from the one or more subscriber data management functions including one or more of:
an authentication server function (AUSF);
a unified data management (UDM) function; and
a user data repository (UDR) function.
4 . The method as recited in claim 1 , wherein detecting the combination of potential fraud signals associated with the SIM card comprises detecting two or more of:
a roaming signal associated with the user equipment;
a batch number associated with the SIM card;
a registration location associated with the SIM card; and
network activity data associated with the user equipment.
5 . The method as recited in claim 4 , wherein the network activity data associated with the user equipment comprises one or more of:
an amount of time that elapsed between registering the user equipment and detected network activity associated with the user equipment;
a duration of network activity associated with the user equipment;
a current location of the network activity associated with the user equipment; and
a time of day of the network activity associated with the user equipment.
6 . The method as recited in claim 1 , wherein applying the one or more machine learning models to the combination of potential fraud signals comprises:
transmitting the combination of potential fraud signals to a cloud-based server device storing the one or more machine learning models; and
receiving the fraud prediction from the cloud-based server device.
7 . The method as recited in claim 1 , wherein executing the one or more remediation actions associated with the user equipment based on the fraud prediction comprises one or more of:
generating and transmitting a fraud alert associated with the user equipment;
adding the user equipment to a fraud watchlist; and
blocking the user equipment from accessing the telecommunication network.
8 . The method as recited in claim 1 , wherein the telecommunication network comprises a fifth generation (5G) mobile communication network.
9 . A system comprising:
at least one processor:
memory in electronic communication with the at least one processor; and
instructions stored in the memory, the instructions being executable by the at least one processor to:
register a user equipment with a telecommunication network based on one or more interactions with a subscriber identity module (SIM) card installed on the user equipment;
receive, from a user plane function (UPF) implemented on the telecommunication network, latency data collected by the UPF for communications associated with the user equipment;
detect a combination of potential fraud signals associated with the SIM card based on a combination of subscriber data received from one or more subscriber data management functions and latency data collected by the UPF, wherein the subscriber data is obtained when registering the user equipment with the telecommunication network;
applying one or more machine learning models to the combination of potential fraud signals to generate a fraud prediction associated with the SIM card, the fraud prediction being based at least in part on an observed latency from the latency data exceeding an expected latency for the user equipment by a threshold amount, the expected latency being based on the subscriber data; and
execute one or more remediation actions associated with the user equipment based on the fraud prediction.
10 . The system as recited in claim 9 , wherein the instructions stored in the memory are further executable by the at least one processor to register the user equipment with the telecommunication network based on the one or more interactions with the SIM card installed on the user equipment by:
receiving a communication from the user equipment comprising a unique identifier stored on the SIM card;
retrieving an authentication key associated with the unique identifier;
generating a random number and a first encryption of the random number utilizing the authentication key;
transmitting the random number to the user equipment;
receiving a second encryption of the random number from the user equipment; and
registering the user equipment based on the first encryption matching the second encryption.
11 . The system as recited in claim 9 , wherein the subscriber data is received from the one or more subscriber data management functions including one or more of:
an authentication server function (AUSF);
a unified data management (UDM) function; or
a user data repository (UDR) function.
12 . The system as recited in claim 9 , wherein the instructions stored in the memory are further executable by the at least one processor to detect the combination of potential fraudulent signals associated with the SIM card by detecting any two or more of:
a roaming signal associated with the user equipment;
a batch number associated with the SIM card;
a registration location associated with the SIM card; and
network activity data associated with the user equipment.
13 . The system as recited in claim 12 , wherein the network activity data associated with the user equipment comprises one or more of:
an amount of time that elapsed between registering the user equipment and detected network activity associated with the user equipment;
a duration of network activity associated with the user equipment;
a current location of the network activity associated with the user equipment; and
a time of day of the network activity associated with the user equipment.
14 . The system as recited in claim 9 , wherein applying one or more machine learning models to the combination of potential fraud signals to generate the fraud prediction associated with the SIM card further comprises:
transmitting the combination of potential fraud signals to a cloud-based server device storing the one or more machine learning models; and
receiving the fraud prediction from the cloud-based server device.
15 . The system as recited in claim 9 , wherein the instructions stored in the memory are further executable by the at least one processor to execute the one or more remediation actions associated with the user equipment based on the fraud prediction by performing one or more of:
generating and transmitting a fraud alert associated with the user equipment;
adding the user equipment to a fraud watchlist; and
blocking the user equipment from accessing the telecommunication network.
16 . The system as recited in claim 9 , wherein the telecommunication network comprises a fifth generation (5G) mobile communication network.
17 . In a fifth generation (5G) mobile communication network including one or more subscriber data management functions, a method for detecting fraudulent subscriber identity module (SIM) card usage comprising:
registering a user equipment with the 5G mobile communication network based on one or more interactions with a SIM card installed on the user equipment;
receiving, from a user plane function (UPF) implemented on the 5G mobile communication network, latency data collected by the UPF for communications associated with the user equipment;
detecting a combination of potential fraud signals associated with the SIM card based on a combination of subscriber data received from one or more subscriber data management functions and the latency data collected by the UPF, wherein the subscriber data is being obtained when registering the user equipment with the 5G mobile communication network;
applying one or more machine learning models to the combination of potential fraud signals to generate a fraud prediction associated with the SIM card, the fraud prediction being based at least in part on an observed latency from the latency data exceeding an expected latency for the user equipment by a threshold amount, the expected latency being based on the subscriber data; and
generating and transmitting a fraud alert associated with the user equipment based on the fraud prediction.
18 . The method as recited in claim 17 , wherein the subscriber data is received from at least one of:
an authentication server function (AUSF);
a unified data management (UDM) function; or
a user data repository (UDR) function.
19 . The method as recited in claim 17 , wherein detecting the combination of potential fraud signals associated with the SIM card comprises detecting two or more of:
a roaming signal associated with the user equipment;
a batch number associated with the SIM card;
a registration location associated with the SIM card; and
network activity data associated with the user equipment.