Communications methods and apparatus for dynamic detection and/or mitigation of anomalies

1. A method of processing calls to the customer, the method comprising:

processing a first set of call detail records of the customer, each call detail record in said first set of call detail records corresponding to an individual call and including multiple information fields providing information about the individual call to which the call detail record corresponds, said processing including:

generating from some of said call detail records of the first set of call detail records, on a per call detail record basis, one or more Field Group IDs using a hash function;

generating for call detail records corresponding to a first Field Group ID a first set of key performance indicators, said first set of key performance indicators including one or more key performance indicators corresponding to the first Field Group ID, said one or more key performance indicators including at least a first key performance indicator; and

determining that a first key performance indicator violation has occurred for the first Field Group ID when the first key performance indicator exceeds a first dynamic performance threshold.

2. The method of claim 1 , further comprising:

in response to determining that a first key performance indicator violation has occurred for the first Field Group ID, determining if the first Field Group ID is being tracked.

3. The method of claim 2 , further comprising:

if the First Field Group ID is not being tracked, initiating tracking of violations for the first Field Group ID; and

if the First Field Group ID is being tracked updating violation information.

4. The method of claim 3 ,

wherein updating violation information includes modifying a severity incident level; and

checking if the modified severity incident level exceeds an action threshold; and

performing a violation mitigation operation when the modified severity level exceeds said action threshold.

5. The method of claim 4 , wherein performing a violation mitigation operation includes at least one of: i) notifying a system operator or analyst of the detected first key performance indicator violation; ii) completing future incoming calls corresponding to the first Field Group ID to a device corresponding to a called party number included in the incoming call with an indication that the incoming call corresponds to suspicious activity; iii) redirecting future incoming calls corresponding to the first Field Group ID to a validation service; iv) assigning future incoming calls corresponding to the first Field Group ID to a lower incoming call priority than an incoming call that doesn't correspond to the first Field Group ID when placing the incoming call in a call handling queue; v) delivering future incoming calls corresponding to the first Field Group ID to voice mail or vi) dropping or blocking future incoming calls corresponding to the first Field Group ID.

6. The method of claim 1 , further comprising:

updating the first dynamic performance threshold based on the first key performance indicator.

7. The method of claim 1 , further comprising: generating the first dynamic performance threshold, said generating the first dynamic performance threshold including determining an exponentially weighted moving average (EMA) for the first key performance indicator corresponding to the first Field Group ID from said previous call detail records of said customer.

8. The method of claim 7 , wherein generating the first dynamic performance threshold further includes generating an exponentially weighted moving variance (EMV) for the first key performance indicator corresponding to the first Field Group ID from said previous call detail records of said customer.

9. The method of claim 8 , wherein generating the first dynamic performance threshold further includes selecting a sensitivity parameter which defines a threshold number of standard deviations and generating a margin value based on the EMV of the first key performance indicator and the selected sensitivity parameter.

10. The method of claim 1 ,

wherein said customer is an enterprise customer; and

wherein said step of processing call detail records of said customer is performed on a periodic basis for calls to or from said enterprise customer.

11. The method of claim 6 further comprising:

processing a second set of call detail records of the customer, each call detail record in said second set of call detail records corresponding to an individual call and including multiple information fields providing information about the individual call to which the call detail record corresponds, said processing including:

generating from some of said second set of call detail records, on a per call detail record basis, one or more Field Group IDs using said hash function;

generating for call detail records of the second set of call detail records corresponding to the first Field Group ID a first set of key performance indicators for the second set of call detail records, said first set of key performance indicators for the second set of call detail records including one or more key performance indicators corresponding to the first Field Group ID, said one or more key performance indicators including at least the first key performance indicator;

determining that a first key performance indicator violation has occurred for the first Field Group ID when the first key performance indicator for the second set of call detail records exceeds said updated first dynamic performance threshold.

12. The method of claim 1 , wherein said first set of key performance indicators includes a second key performance indicator, said method further comprising:

determining that a second key performance indicator violation has occurred for the first Field Group ID when the second key performance indicator exceeds a second dynamic performance threshold.

13. The method of claim 12 further comprising:

determining an aggregate key performance indicator based on said first and second key performance indicators; and

determining that an aggregate key performance indicator violation has occurred for the first Field Group ID when the aggregate key performance indicator exceeds an aggregate dynamic performance threshold.

14. A system of processing calls to a customer, the system comprising:

a traffic monitoring node including:

memory; and

a processor that controls the traffic monitoring node to:

process a first set of call detail records of the customer, each call detail record in said first set of call detail records corresponding to an individual call and including multiple information fields providing information about the individual call to which the call detail record corresponds, said processing including:

generating from some of said call detail records of the first set of call detail records, on a per call detail record basis, one or more Field Group IDs using a hash function;

generating for call detail records corresponding to a first Field Group ID a first set of key performance indicators, said first set of key performance indicators including one or more key performance indicators corresponding to the first Field Group ID, said one or more key performance indicators including at least a first key performance indicator; and

determining that a first key performance indicator violation has occurred for the first Field Group ID when the first key performance indicator exceeds a first dynamic performance threshold.

15. The system of claim 14 , wherein said processing further includes:

in response to determining that a first key performance indicator violation has occurred for the first Field Group ID, determining if the first Field Group ID is being tracked;

if the First Group ID is not being tracked, initiating tracking of violations for the first Field Group ID; and

if the First Group ID is being tracked updating violation information.

16. The system of claim 15 ,

wherein updating violation information includes modifying a severity incident level; and

checking if the modified severity incident level exceeds an action threshold; and

wherein said system further includes an enforcement node, said enforcement node including a second processor, said second processor configured to control the enforcement node to perform a violation mitigation operation when the modified severity level exceeds said action threshold.

17. The system of claim 14 , wherein the first dynamic performance threshold is a threshold which was generated from analysis of previous call detail records of said customer.

18. The system of claim 14 , wherein said processing further includes:

updating the first dynamic performance threshold based on the first key performance indicator.

19. The system of claim 14 , wherein said processing further includes generating the first dynamic performance threshold, said generating the first dynamic performance threshold includes determining an exponentially weighted moving average (EMA) for the first key performance indicator corresponding to the first Field Group ID from said previous call detail records of said customer.

20. A non-transitory computer readable medium including a first set of computer executable instructions which when executed by a processor of a traffic monitoring node cause the traffic monitoring node to:

process a first set of call detail records of a customer, each call detail record in said first set of call detail records corresponding to an individual call and including multiple information fields providing information about the individual call to which the call detail record corresponds, said processing including:

generating from some of said call detail records of the first set of call detail records, on a per call detail record basis, one or more Field Group IDs using a hash function;

generating for call detail records corresponding to a first Field Group ID a first set of key performance indicators, said first set of key performance indicators including one or more key performance indicators corresponding to the first Field Group ID, said one or more key performance indicators including at least a first key performance indicator; and

determining that a first key performance indicator violation has occurred for the first Field Group ID when the first key performance indicator exceeds a first dynamic performance threshold.