Method and apparatus for providing fraud detection using hot or cold originating attributes
View Patent ↗An approach provides fraud detection in support of data communication services. A list of single-event attributes (e.g., hot or cold attributes) is generated and includes a network address of an end user host originating a data call or a calling party identification (e.g., Automatic Number Identification (ANI) or an originating Calling Line Identification (CLI)) for network access, wherein entries of the list specify values of the hot attributes. An attribute value associated with the data call is compared with the entries. A fraud alert is generated if the attribute value matches one of the entries.
1. A method for detecting unauthorized use of data services, the method comprising the steps of:
generating a list of single-event attributes that include a network address of an end user host associated with a data call for network access, wherein entries of the list specify values of the single-event attributes;
comparing an attribute value associated with the data call with the entries; and
generating a fraud alert if the attribute value matches one of the entries.
2. A method according to claim 1 , wherein the data call is a dial-up call, and the single-event attributes further include a caller identification attribute specifying an originating Automatic Number Identification (ANI) or an originating Calling Line Identification (CLI).
3. A method according to claim 1 , further comprising the step of:
setting the network address as one of the single-event attributes using wildcard characters to indicate a range of network addresses.
4. A method according to claim 1 , further comprising the step of:
determining whether the data call is completed, wherein the fraud alert is generated if the data call is completed.
5. A method according to claim 1 , further comprising the step of:
determining whether the data call is associated with a billed event, wherein the fraud alert is generated if the data call is associated with a billed event.
6. A method according to claim 1 , wherein the single-event attributes further include an originating country attribute specifying a country code associated with the data call.
7. A method according to claim 1 , wherein the single-event attributes includes hot attributes or cold attributes.
8. An apparatus for detecting unauthorized use of data services, the apparatus comprising:
a processor configured to generate a list of single-event attributes that include a network address of an end user host originating a data call for network access, wherein entries of the list specify values of the single-event attributes; and
a memory configured to store the list,
wherein the processor compares an attribute value associated with the data call with the entries and generates a fraud alert if the attribute value matches one of the entries.
9. An apparatus according to claim 8 , wherein the data call is a dial-up call, and the single-event attributes further include a caller identification attribute specifying an originating Automatic Number Identification (ANI) or an originating Calling Line Identification (CLI).
10. An apparatus according to claim 8 , further comprising the step of:
setting the network address as one of the single-event attributes using wildcard characters to indicate a range of network addresses.
11. An apparatus according to claim 8 , wherein the processor is further configured to determine whether the data call is completed, and the fraud alert is generated if the data call is completed.
12. An apparatus according to claim 8 , wherein the processor is further configured to determine whether the data call is associated with a billed event, and the fraud alert is generated if the data call is associated with a billed event.
13. An apparatus according to claim 8 , wherein the single-event attributes further include an originating country attribute specifying a country code associated with the data call.
14. An apparatus according to claim 8 , wherein the single-event attributes includes hot attributes or cold attributes.
15. A system for detecting unauthorized use of data services, the system comprising:
means for generating a list of single-event attributes that include a network address of an end user host originating a data call for network access, wherein entries of the list specify values of the single-event attributes;
means for comparing an attribute value associated with the data call with the entries; and
means for generating a fraud alert if the attribute value matches one of the entries.
16. A system according to claim 15 , wherein the data call is a dial-up call, and the single-event attributes further include a caller identification attribute specifying an originating Automatic Number Identification (ANI) or an originating Calling Line Identification (CLI).
17. A system according to claim 15 , further comprising:
means for setting the network address as one of the single-event attributes using wildcard characters to indicate a range of network addresses.
18. A system according to claim 15 , further comprising:
means for determining whether the data call is completed, wherein the fraud alert is generated if the data call is completed.
19. A system according to claim 15 , further comprising:
means for determining whether the data call is associated with a billed event, wherein the fraud alert is generated if the data call is associated with a billed event.
20. A system according to claim 15 , wherein the single-event attributes further include an originating country attribute specifying a country code associated with the data call.
21. A system according to claim 15 , wherein the single-event attributes includes hot attributes or cold attributes.
22. A method for detecting unauthorized use of data services, the method comprising the steps of:
generating a list of single-event attributes associated with a data call for network access, wherein entries of the list specify values of the single-event attributes, and the data call is a dial-up call, the single-event attributes including a caller identification attribute specifying an originating Automatic Number Identification (ANT) or an originating Calling Line Identification (CLI);
comparing an attribute value associated with the data call with the entries; and
generating a fraud alert if the attribute value matches one of the entries.
23. A method according to claim 22 , farther comprising the step of:
setting the network address as one of the single-event attributes using wildcard characters to indicate a range of network addresses.
24. A method according to claim 22 , farther comprising the step of:
determining whether the data call is completed, wherein the fraud alert is generated if the data call is completed.
25. A method according to claim 22 , farther comprising the step of:
determining whether the data call is associated with a billed event, wherein the fraud alert is generated if the data call is associated with a billed event.
26. A method according to claim 22 , wherein the single-event attributes further include an originating country attribute specifying a country code associated with the data call.
27. A method according to claim 22 , wherein the single-event attributes includes hot attributes or cold attributes.