Systems and methods for JIP and CLLI matching in telecommunications metadata and machine-learning
Embodiments described herein provide for systems and methods for verifying authentic JIPs associated with ANIs using CLLIs known to be associated with the ANIs, allowing a computer to authenticate calls using the verified JIPs, among various factors. The computer builds a trust model for JIPs by correlating unique CLLIs to JIPs. A malicious actor might spoof numerous ANIs mapped to a single CLLI, but the malicious actor is unlikely to spoof multiple CLLIs due to the complexity of spoofing the volumes of ANIs associated with multiple CLLIs, so the CLLIs can be trusted when determining whether a JIP is authentic. The computer identifies an authentic JIP when the trust model indicates that a number of CLLIs associated with the JIP satisfies one or more thresholds. A machine-learning architecture references the fact that the JIP is authentic as an authentication factor for downstream call authentication functions.
1 . A computer-implemented method comprising:
receiving, by a computer, signaling metadata for a plurality of prior calls originated at a plurality of calling devices, the signaling metadata for each of the plurality of prior calls including an Automated Number Identification (ANI) and a Jurisdiction Information Parameter (JIP);
identifying, by the computer, a Common Language Location Identifier Code (CLLI) associated with each ANI by querying a telecommunications database using the ANI;
determining, by the computer, a number of unique CLLIs associated with each JIP in the signaling metadata of the plurality of prior calls;
identifying, by the computer, a verified JIP in the signaling metadata of the plurality of prior calls in response to determining that the number of unique CLLIs associated with the verified JIP satisfies a threshold number of unique CLLIs; and
executing, by the computer, an authentication operation for an inbound call, using an inbound JIP in inbound signaling metadata of the inbound call and one or more verified JIPs stored in a database.
2 . The method according to claim 1 , further comprising determining, by the computer, a risk score for the inbound call by executing one or more authentication operations using the inbound signaling metadata for the inbound call.
3 . The method according to claim 2 , wherein executing the authentication operation includes:
applying, by the computer, a machine-learning architecture on the inbound signaling metadata of the inbound call to authenticate the inbound call using the risk score.
4 . The method according to claim 1 , further comprising generating, by the computer, an authentication status for the inbound call by executing the authentication operation using the inbound JIP for the inbound call, the authentication status indicating that the inbound JIP for the inbound call corresponds to at least one verified JIP in the database.
5 . The method according to claim 1 , further comprising applying, by the computer, a machine-learning architecture to generate a risk indicator for the inbound call, in response to the computer determining that the inbound JIP of the inbound call fails to match at least one verified JIP.
6 . The method according to claim 1 , wherein determining the number of unique CLLIs associated with each JIP in the signaling metadata of the plurality of prior calls comprises:
comparing, by the computer, the CLLI associated with each ANI to each CLLI in a JIP record associated with each JIP in the signaling metadata of the plurality of prior calls; and
incrementing, by the computer, the number of unique CLLIs associated with each JIP in response to determining that the CLLI associated with the ANI does not match at least one CLLI in the JIP record.
7 . The method according to claim 6 , wherein the JIP record indicates one or more unique CLLIs.
8 . The method according to claim 1 , wherein the threshold number of unique CLLIs corresponds to a global threshold.
9 . The method according to claim 1 , wherein the threshold number of unique CLLIs corresponds to a regional threshold.
10 . The method according to claim 1 , further comprising determining a weighting factor, by the computer, for the JIP in the signaling metadata according to an authentication status based on the number of unique CLLIs associated with the JIP in the signaling metadata and the threshold number of unique CLLIs.
11 . A system comprising:
a computer comprising a processor and configured to:
receive signaling metadata for a plurality of prior calls originated at a plurality of calling devices, the signaling metadata for each of the plurality of prior calls including an Automated Number Identifications (ANI) and a Jurisdiction Information Parameter (JIP);
identify a Common Language Location Identifier Code (CLLI) associated with each ANI by querying a telecommunications database using the ANI;
determine a number of unique CLLIs associated with each JIP in the signaling metadata of the plurality of prior calls;
identify a verified JIP in the signaling metadata of the plurality of prior calls in response to determining that the number of unique CLLIs associated with the verified JIP satisfies a threshold number of unique CLLIs; and
execute an authentication operation for an inbound call, using an inbound JIP in inbound signaling metadata of the inbound call and one or more verified JIPs stored in a database.
12 . The system according to claim 11 , wherein the computer is further configured to determine a risk score for the inbound call by executing one or more authentication operations using the inbound signaling metadata for the inbound call.
13 . The system according to claim 12 , wherein when executing the authentication operation the computer is further configured to:
apply a machine-learning architecture on the inbound signaling metadata of the inbound call to authenticate the inbound call using the risk score.
14 . The system according to claim 11 , wherein the computer is further configured to generate an authentication status for the inbound call by executing the authentication operation using the inbound JIP for the inbound call, the authentication status indicating that the inbound JIP for the inbound call corresponds to at least one verified JIP in the database.
15 . The system according to claim 11 , wherein the computer is further configured to apply a machine-learning architecture to generate a risk indicator for the inbound call, in response to the computer determining that the inbound JIP of the inbound call fails to match at least one verified JIP.
16 . The system according to claim 11 , wherein when determining the number of unique CLLIs associated with each JIP the computer is further configured to:
compare the CLLI associated with each ANI to each CLLI in a JIP record associated with each JIP in the signaling metadata of the plurality of prior calls; and
increment the number of unique CLLIs associated with each JIP in response to determining that the CLLI associated with the ANI does not match at least one CLLI in the JIP record.
17 . The system according to claim 16 , wherein the JIP record indicates one or more unique CLLIs.
18 . The system according to claim 11 , wherein the threshold number of unique CLLIs corresponds to a global threshold.
19 . The system according to claim 11 , wherein the threshold number of unique CLLIs corresponds to a regional threshold.
20 . The system according to claim 11 , wherein the computer is further configured to determine a weighting factor for the JIP in the signaling metadata according to an authentication status based on the number of unique CLLIs associated with the JIP in the signaling metadata and the threshold number of unique CLLIs.