Method and apparatus for providing fraud detection using connection frequency and cumulative duration thresholds

1. A method for detecting unauthorized use of data services associated with an account, the method comprising the steps of:

tracking number of data calls, corresponding to a host identifier, for access to a data network over a predetermined time period;

determining a cumulative duration of the data calls;

determining whether the number of the data calls and the cumulative duration satisfy a combination of, respectively, a first threshold and a second threshold;

setting the first threshold corresponding to the number of the data calls based on an access type and the second threshold corresponding to the cumulative duration based on another access type, wherein the access types include one or more of: 800 number access, access corresponding to a particular hostUserID, access from a particular geographical region, access from a logical partition, and access from an originating network; and

indicating a potential fraudulent use of the account via a single alarm, if the combination of thresholds is satisfied,

wherein the first threshold and the second threshold are assigned different levels of precedence.

2. A method according to claim 1 , wherein the data calls correspond to a log-in identifier or a host user identifier instead of the host identifier.

3. A method according to claim 2 , wherein the number of data calls are tracked based on originating country, geographical region, logical partition, or originating data network.

4. A method according to claim 1 , wherein the data calls are associated with a common account.

5. A method according to claim 1 , wherein the data calls are dial-up sessions, and one of the access types indicates a toll-free access number for the dial-up sessions.

6. A method according to claim 1 , wherein the cumulative duration is determined by summing respective durations of the data calls.

7. A method according to claim 1 , wherein one threshold violation condition is preferentially reported in the indication of potential fraudulent use.

8. An apparatus for detecting unauthorized use of data services associated with an account, the apparatus comprising:

a communication interface configured to receive information specifying number of data calls, corresponding to a host identifier, made to access a data network over a predetermined time period and a cumulative duration of the data calls; and

a processor configured to determine whether the number of the data calls and the cumulative duration satisfy a combination of, respectively, a first threshold and a second threshold, the processor being further configured to set the first threshold to correspond to the number of the data calls based on an access type and to set the second threshold to correspond to the cumulative duration based on another access type, wherein the access types include one or more of: 800 number access, access corresponding to a particular hostUserID, access from a particular geographical region, access from a logical partition, and access from an originating network,

wherein a potential fraudulent use of the account, via a single alarm, is indicated, if the combination of thresholds is satisfied, and

wherein the first threshold and the second threshold are assigned different levels of precedence.

9. An apparatus according to claim 8 , wherein the data calls correspond to a log-in identifier or a host user identifier instead of the host identifier.

10. An apparatus according to claim 9 , wherein the number of data calls are tracked based on originating country, geographical region, logical partition, or originating data network.

11. An apparatus according to claim 8 , wherein the data calls are associated with a common account.

12. An apparatus according to claim 8 , wherein one of the access types indicates a toll-free access number.

13. An apparatus according to claim 8 , wherein the data calls are associated with a common account.

14. An apparatus for detecting unauthorized use of data services associated with an account, the apparatus comprising:

means for tracking number of data calls, corresponding to a host identifier, for access to a data network over a predetermined time period;

means for determining a cumulative duration of the data calls;

means for determining whether the number of the data calls and the cumulative duration satisfy a combination of, respectively a first threshold and a second threshold;

means for setting the first threshold corresponding to the number of the data calls based on an access type and setting the second threshold corresponding to the cumulative duration based on another access type, wherein the access types include one or more of: 800 number access, access corresponding to a particular hostUserID, access from a particular geographical region, access from a logical partition, and access from an originating network; and

means for indicating a potential fraudulent use of the account, via a single alarm, if the combination of thresholds is satisfied,

wherein the first threshold and the second threshold are assigned different levels of precedence.

15. An apparatus according to claim 14 , wherein the data calls correspond to a log-in identifier or a host user identifier instead of the host identifier.

16. An apparatus according to claim 15 , wherein the number of data calls are tracked based on originating country, geographical region, logical partition, or originating data network.

17. An apparatus according to claim 14 , wherein the data calls are dial-up sessions, and one of the access types indicates a toll-free access number for the dial-up sessions.

18. A method for detecting unauthorized use of data services associated with an account, the method comprising the steps of:

monitoring frequency of data calls, corresponding to a host identifier, to access a data network;

determining a cumulative duration of the data calls;

comparing the frequency and the cumulative duration with a frequency threshold and a duration threshold, respectively, to result in a combined comparison;

setting the frequency threshold corresponding to the number of the data calls based on an access type and setting the duration threshold corresponding to the cumulative duration based on another access type, wherein the access types include one or more of: 800 number access, access corresponding to a particular hostUserID, access from a particular geographical region, access from a logical partition, and access from an originating network; and

selectively generating a fraud alert for the account, via a single alarm, based on the combined comparison,

wherein the frequency threshold and the duration threshold are assigned different levels of precedence.

19. A method according to claim 18 , wherein the number of data calls are tracked based on originating country, geographical region, logical partition, or originating data network.

20. A method according to claim 19 , wherein the data calls correspond to a log-in identifier or a host user identifier instead of the host identifier.

21. The method according to claim 7 , further comprising:

enabling a precedence order relating to the assigned different levels of precedence; and

determining which of multiple violations is to be included in the indication of potential fraudulent use, by performing threshold comparisons in a particular sequence.