Fraud detection in interactive voice response systems
Systems and methods for call detail record (CDR) analysis to determine a risk score for a call and identify fraudulent activity and for fraud detection in Interactive Voice Response (IVR) systems. An example method may store information extracted from received calls. Queries of the stored information may be performed to select data using keys, wherein each key relates to one of the received calls, and wherein the queries are parallelized. The selected data may be transformed into feature vectors, wherein each feature vector relates to one of the received calls and includes a velocity feature and at least one of a behavior feature or a reputation feature. A risk score for the call may be generated during the call based on the feature vectors.
1. A computer-implemented method comprising:
receiving, by a computer, a plurality of timestamps and corresponding interaction steps with an interactive voice response (IVR) system during a call received by the IVR system;
extracting, by the computer, a behavior feature of the call during the call based upon the plurality of timestamps and the corresponding interaction steps;
generating, by the computer, during the call a feature vector based upon the behavior feature of the call extracted based upon the plurality of timestamps and the corresponding interaction steps with the IVR system; and
executing, by the computer, during the call a machine learning model on the feature vector to determine a risk score of the call.
2. The computer-implemented method of claim 1 , wherein the behavior feature includes a sequence of actions in the interaction steps with the IVR system.
3. The computer-implemented method of claim 1 , wherein the behavior feature includes at least one of an action taken in the interaction steps with the IVR system, an amount of time elapsed between actions taken in the interaction steps with the IVR system, providing incorrect information to the IVR system, a number of times a specific activity in the IVR was performed, a number of times the IVR system was called during a measure of time, a volume or a duration of at least one dual tone dual-tone multi frequency (DTMF) tone in the interaction steps with the IVR system, an amount of time elapsed between DTMF tones, a use of voice in the interaction steps with the IVR system, an amount of time elapsed between a beginning of an IVR prompt and a user's spoken response to the IVR prompt, or an amount of time elapsed between an IVR prompt and a corresponding action taken in the interaction steps with the IVR system.
4. The computer-implemented method of claim 1 , wherein the step of extracting the behavior feature of the call comprises:
representing, by the computer, each interaction step with one or more action words.
5. The computer-implemented method of claim 1 , wherein the step of executing the machine learning model to determine the risk score of the call comprises:
executing, by the computer, the machine learning model on the feature vector to determine the risk score of the call during the call.
6. The computer-implemented method of claim 1 , further comprising:
triggering, by the computer, a computer operation based upon the risk score of the call.
7. The computer-implemented method of claim 1 , wherein the triggered computer operation comprises at least one of displaying the risk score on a display during the call, storing the risk score in a database during the call, altering an IVR call flow during the call, notifying police, notifying an owner of the IVR system, disabling a feature in the IVR system during the call, locking down the IVR system, requiring alternative identification during the call, or requesting additional information during the call.
8. The computer-implemented method of claim 1 , wherein the risk score includes a label selected from a finite set of levels.
9. The computer-implemented method of claim 8 , wherein the risk score further includes a numeric value indicating a confidence level of the selected label.
10. The computer-implemented method of claim 1 , further comprising:
training, by the computer, the machine learning model utilizing labeled feature vectors extracted from previous interaction steps with the IVR system.
11. A system comprising:
a non-transitory storage medium storing a plurality of computer program instructions; and
a processor electrically coupled to the non-transitory storage medium and configured to execute the plurality of computer program instructions to:
receive a plurality of timestamps and corresponding interaction steps with an interactive voice response (IVR) system during a call received by the IVR system;
extract a behavior feature of the call during the call based upon the plurality of timestamps and the corresponding interaction steps;
generate during the call a feature vector based upon the behavior feature of the call extracted based upon the plurality of timestamps and the corresponding interaction steps with the IVR system; and
deploy during the call a machine learning model on the feature vector to determine a risk score of the call.
12. The system of claim 11 , wherein the behavior feature includes a sequence of actions in interaction steps with the IVR system.
13. The system of claim 11 , wherein the behavior feature includes at least one of an action taken in the interaction steps with the IVR system, an amount of time elapsed between actions taken in the interaction steps with the IVR system, providing incorrect information to the IVR system, a number of times a specific activity in the IVR was performed, a number of times the IVR system was called during a measure of time, a volume or a duration of at least one dual tone dual-tone multi frequency (DTMF) tone in the interaction steps with the IVR system, an amount of time elapsed between DTMF tones, a use of voice in the interaction steps with the IVR system, an amount of time elapsed between a beginning of an IVR prompt and a user's spoken response to the IVR prompt, or an amount of time elapsed between an IVR prompt and a corresponding action taken in interaction steps with the IVR system.
14. The system of claim 11 , wherein the processor is configured to further execute the plurality of computer program instructions to:
represent each interaction step with one or more action words.
15. The system of claim 11 , wherein the processor is configured to further execute the plurality of computer program instructions to:
deploy the machine learning model on the feature vector to determine the risk score of the call during the call.
16. The system of claim 11 , wherein the processor is configured to further execute the plurality of computer program instructions to:
trigger a computer operation based upon the risk score of the call.
17. The system of claim 11 , wherein the triggered computer operation comprises at least one of displaying the risk score on a display during the call, storing the risk score in a database during the call, altering an IVR call flow during the call, notifying police, notifying an owner of the IVR system, disabling a feature in the IVR system during the call, locking down the IVR system, requiring alternative identification during the call, or requesting additional information during the call.
18. The system of claim 11 , wherein the risk score includes a label selected from a finite set of levels.
19. The system of claim 18 , wherein the risk score further includes a numeric value indicating a confidence level of the selected label.
20. The system of claim 11 , wherein the processor is configured to further execute the computer program instructions to:
train the machine learning model utilizing labeled feature vectors extracted from previous interaction steps with the IVR system.