MULTI-LAYER APPROACH TO MONITOR CELL PHONE USAGE IN RESTRICTED AREAS

1 . A method comprising:

in response to determining a mobile device has entered a predetermined area comprising a geo-location, determining, by one or more processors, a length of time the mobile device remains in the predetermined area;

in response to determining the length of time exceeds a first predetermined threshold, incrementing, by one or more processors, a threat level associated with the mobile device by a first predetermined amount, wherein the first predetermined threshold is calculated using a predictive model created with historical information derived from a management system for a telecom network, said predictive model associating said length of time with a threat indication;

in response to determining the threat level associated with the mobile device exceeds a second predetermined threshold, comparing, by one or more processors, usage of the mobile device with one or more existing analytics models using a set of analytic techniques that describe a first behavior of a regular user with a second behavior of a suspect user stored as part of said historical information;

in response to determining the usage of the mobile device matches a behavior associated with an existing criminal model stored as part of said historical information, incrementing, by one or more processors, the threat level associated with the mobile device by a second predetermined amount;

in response to determining the threat level associated with the mobile device exceeds a third predetermined threshold, using a set of cognitive techniques to further assess, by one or more processor, potential behavior of a user based on data collected from said mobile device;

in response to determining an analysis of said data collected from the usage of the mobile device is indicative of a potential attempt to commit a predetermined negative action, incrementing, by one or more processors, the threat level associated with the mobile device by a third predetermined amount; and

in response to determining the threat level associated with the mobile device exceeds a fourth predetermined threshold, initiating, by one or more processors, a predefined action linked to said mobile device intended to prevent said predetermined negative action.

2 . The method as recited in claim 1 ,

wherein said predefined action includes sending an alert to appropriate security personnel.

3 . The method as recited in claim 1 ,

wherein said predefined action includes blocking a call placed on said mobile device.

4 . The method as recited in claim 1 ,

wherein said threat level is measured by a tally of points assessed by said predictive model, said tally of points used to determine said predetermined thresholds associated with said threat level.

5 . The method as recited in claim 1 ,

wherein said first predetermined amount is a predetermined number of points, said second predetermined amount is a second predetermined number of points, said third predetermined amount is a third predetermined number of points.

6 . The method as recited in claim 1 ,

wherein the length of time and the first predetermined amount is recalculated on a configurable schedule to recalibrate a management system in response to new data being processed.

7 . The method as recited in claim 1 ,

wherein the existing models contain attributes including an average number of calls, one or more distinct destination numbers, a call duration, geographic information of one or more target numbers.

8 . The method as recited in claim 1 ,

wherein the existing models are recalibrated in the management system to continuously learn from behaviors.

9 . The method as recited in claim 1 , further comprising:

wherein said cognitive techniques include advanced algorithms including recording of calls, voice recognition, speech-to-text transformation of the calls, sentiment analysis of text to identify a criminal or a malicious intent, analysis of content transmitted via Internet and special messages to further describe behavior of a user.

10 . A computer program product comprising:

a computer-readable storage device; and

a computer-readable program code stored in the computer-readable storage device, the computer readable program code containing instructions executable by a processor of a computer system to implement a method for managing mobile device usage, the method comprising:

in response to determining a mobile device has entered a predetermined area comprising a geo-location, determining a length of time the mobile device remains in the predetermined area;

in response to determining the length of time exceeds a first predetermined threshold, incrementing a threat level associated with the mobile device by a first predetermined amount, wherein the predetermined amount is calculated using a predictive model created with historical information derived from a management system for a telecom network,

in response to determining the threat level associated with the mobile device exceeds a second predetermined threshold, comparing usage of the mobile device with one or more existing models that describe a behavior of a regular user and the behavior of a suspect user;

in response to determining the usage of the mobile device matches a behavior associated with an existing criminal model, incrementing the threat level associated with the mobile device by a second predetermined amount;

in response to determining the threat level associated with the mobile device exceeds a third predetermined threshold, using a set of cognitive techniques to further assess potential behavior of a user;

in response to determining an analysis of data collected from the usage of the mobile device is indicative of a potential attempt to commit a predetermined negative action, incrementing the threat level associated with the mobile device by a third predetermined amount; and

in response to determining the threat level associated with the mobile device exceeds a fourth predetermined threshold, initiating a predefined action intended to prevent said predetermined negative action.

11 . The computer program product as recited in claim 10 , wherein said predefined action includes at least one of sending an alert to appropriate personnel and blocking a call made on said mobile device.

12 . The computer program product as recited in claim 10 , further comprising

said threat level is measured by a tally of points assessed by said predictive model.

13 . The computer program product as recited in claim 10 , wherein said first predetermined amount is a predetermined number of points, said second predetermined amount is a second predetermined number of points, said third predetermined amount is a third predetermined number of points.

14 . The computer program product as recited in claim 10 , wherein

the length of time and the first predetermined amount is recalculated on a configurable schedule to recalibrate a management system in response to new data being processed.

15 . The computer program product as recited in claim 10 , wherein the existing models contain attributes including an average number of calls, one or more distinct destination numbers, a call duration, geographic information of one or more target numbers.

16 . The computer program product as recited in claim 10 , wherein the existing models are recalibrated in the management system to continuously learn from behaviors.

17 . The computer program product as recited in claim 10 , wherein said cognitive techniques include advanced algorithms including recording of calls, voice recognition, speech-to-text transformation of the calls, sentiment analysis of text to identify a criminal or a malicious intent, analysis of content transmitted via Internet and special messages to further describe behavior of a user.

18 . A computer system comprising:

a processor;

a memory coupled to said processor; and

a computer readable storage device coupled to the processor, the storage device containing instructions executable by the processor via the memory to implement a method for managing mobile device usage, the method comprising:

in response to determining a mobile device has entered a predetermined area comprising a geo-location, determining a length of time the mobile device remains in the predetermined area;

in response to determining the length of time exceeds a first predetermined threshold, incrementing a threat level associated with the mobile device by a first predetermined amount, wherein the predetermined amount is calculated using a predictive model created with historical information derived from a management system for a telecom network,

in response to determining the threat level associated with the mobile device exceeds a second predetermined threshold, comparing usage of the mobile device with one or more existing models that describe a behavior of a regular user and the behavior of a suspect user;

in response to determining the usage of the mobile device matches a behavior associated with an existing criminal model, incrementing the threat level associated with the mobile device by a second predetermined amount;

in response to determining the threat level associated with the mobile device exceeds a third predetermined threshold, using a set of cognitive techniques to further assess potential behavior of a user;

in response to determining an analysis of data collected from the usage of the mobile device is indicative of a potential attempt to commit a predetermined negative action, incrementing the threat level associated with the mobile device by a third predetermined amount; and

in response to determining the threat level associated with the mobile device exceeds a fourth predetermined threshold, initiating a predefined action intended to prevent said predetermined negative action.

19 . The computer system as recited in claim 18 , wherein the length of time and the first predetermined amount is recalculated on a configurable schedule to recalibrate a management system in response to new data being processed.

20 . The computer system as recited in claims 18 , wherein the existing models are recalibrated in the management system to continuously learn from behaviors.