Telecom-fraud detection using device-location information
View Patent ↗Subject matter described herein is directed to detecting unauthorized use, such as by a cloned mobile device, of wireless telecommunication services. Differences in location patterns of unauthorized and authorized mobile devices are leveraged to detect likely fraudulent uses. For example, a location-pattern entropy of an authorized mobile device is tracked. A change in the location-pattern entropy suggests an unauthorized use of the mobile device's account.
1. One or more non-transitory computer-readable media having computer-executable instructions embodied thereon that, when executed, perform a method of detecting unauthorized use of telecommunication services that is attributable to an account, the method comprising:
receiving location information that describes a location of a mobile device, which is authorized to use services attributable to the account;
using the location information to quantify a measure of location uncertainty, which suggests a variability of the location information that was received,
wherein the measure of location uncertainty is calculated based on a measure of Shannon entropy defined by
H
(
A
)
=
-
∑
i
=
1
m
(
k
i
/
T
)
log
2
(
k
i
/
T
)
;
and
wherein k i is equal to a number of times the mobile device appeared at a particular location, and T is equal to a total number of appearances of the mobile device;
upon receiving subsequent location information, applying differential analysis to assess an effect of the subsequent location information on the measure of Shannon entropy; and
when the effect includes a change that exceeds a threshold, deeming that the subsequent location information describes another communication session of a different mobile device.
2. The one or more computer-readable media of claim 1 , wherein the location information includes a starting location in which a communication session is initiated, an ending location in which the communication session is terminated, or a combination thereof.
3. The one or more computer-readable media of claim 1 , wherein the location information includes a cell, a sector, a city, a zip code, a state, a geographical coordinate, or a combination thereof.
4. The one or more computer-readable media of claim 1 , wherein the measure of location uncertainty includes a measure of Shannon entropy.
5. The one or more computer-readable media of claim 1 , wherein the differential analysis calculates a difference between a first weighted moving average of location information, which is received prior to receipt of the subsequent location information, and a second weighted moving average that includes the subsequent location information.
6. One or more non-transitory computer-readable media having computer-executable instructions embodied thereon that, when executed, perform a method of detecting unauthorized use of telecommunication services that is attributable to an account, the method comprising:
receiving a set of communication records that describes communication sessions of a mobile device, which is authorized to use services attributable to the account;
using the set of communication records to quantify a first weighted moving average of Shannon entropy, which suggests a variability of an attribute included in the communication records,
wherein Shannon entropy is calculated using a formula that is represented by:
H
(
A
)
=
-
∑
i
=
1
m
(
k
i
/
T
)
log
2
(
k
i
/
T
)
,
in which k i is equal to a number of times the mobile device appeared at a particular location T is equal to a total number of appearances of the mobile device, and
wherein the weighted moving average is calculated using a formula represented by:
H i =(1−α) H i-1 +αh i ,
in which α is a constant, H i-1 is equal to a weighted average Shannon entropy of location information for a duration of time prior to receipt of the subsequent communication information, h i is equal to a Shannon entropy calculated using the subsequent communication information;
receiving subsequent communication records, which are used to quantify a second weighted moving average of Shannon entropy;
subtracting the first moving average from the second moving average to calculate a difference between the first moving average and the second moving average; and
when the difference satisfies a threshold, deeming that the subsequent communication records describe a subsequent communication session of a different mobile device.
7. The one or more computer-readable media of claim 6 , wherein the communication records include location information, which includes a starting location in which the communication session is initiated, an ending location in which the communication session is terminated, or a combination thereof.
8. The one or more computer-readable media of claim 7 , wherein the location information includes a cell, a sector, a city, a zip code, a state, a geographical coordinate, or a combination thereof.
9. The one or more computer-readable media of claim 6 , wherein the threshold is a positive quantity that is about or greater than 20 percent of the first weighted moving average.