Method and apparatus for threat identification through analysis of communications signaling events, and participants
Aspects of the invention determining a threat score of a call traversing a telecommunications network by leveraging the signaling used to originate, propagate and terminate the call. Outer-edge data utilized to originate the call may be analyzed against historical, or third party real-time data to determine the propensity of calls originating from those facilities to be categorized as a threat. Storing the outer edge data before the call is sent over the communications network permits such data to be preserved and not subjected to manipulations during traversal of the communications network. This allows identification of threat attempts based on the outer edge data from origination facilities, thereby allowing isolation of a compromised network facility that may or may not be known to be compromised by its respective network owner. Other aspects utilize inner edge data from an intermediate node of the communications network which may be analyzed against other inner edge data from other intermediate nodes and/or outer edge data.
1. A computer-implemented method comprising:
receiving, by a computer, a first carrier signaling data from a first switching device in a telephone network, the first carrier signaling data utilized by the telephone network to route a phone call to a callee's phone number;
setting, by the computer, a destination routing address of the first carrier signaling data;
transmitting, by the computer, a first continue message to the first switching device with a parameter associated with the destination routing address, such that the first switching device routes the phone call to the destination routing address;
receiving, by the computer, a second carrier signaling data from a second switching device in the telephone network, the second carrier signaling data generated by the second switching device in response to receiving the phone call;
generating, by the computer, a threat score for the phone call based upon comparing the first carrier signaling data to the second carrier signaling data;
transmitting, by the computer, a second continue message to the second switching device with the destination routing address set to the callee's phone number; and
transmitting, by the computer, the threat score to a device associated with the callee.
2. The computer-implemented method of claim 1 , wherein the first carrier signaling data is in at least one of a CAP, a MAP, an SS7, and an API message.
3. The computer-implemented method of claim 1 , wherein the first switching device is an originating switching device of the phone call in the telephone network.
4. The computer-implemented method of claim 1 , wherein the second switching device is a terminating switching device of the phone call in the telephone network.
5. The computer-implemented method of claim 1 , wherein the first and the second switching devices are intermediate switching devices of the telephone network.
6. The computer-implemented method of claim 1 , further comprising:
storing, by the computer, the first carrier signaling data in association with a correlation identifier;
appending, by the computer, the correlation identifier to the first continue message;
in response to the computer receiving the second carrier signaling data:
parsing, by the computer, the second carrier signaling data to extract the correlation identifier; and
retrieving, by the computer, first carrier signaling data utilizing the extracted correlation identifier.
7. A computer-implemented method comprising:
receiving, by a computer, carrier signaling data from a terminating switching device in a telephone network, the carrier signaling data including a destination phone number for a phone call;
generating, by the computer, a threat score for the phone call based upon comparing the received carrier signaling data with a stored carrier signaling data from an originating switching device in the telephone network;
transmitting, by the computer, a continue message containing an instruction to fork the phone call between a call recording function of the computer and the destination phone number in response to determining that the threat score exceeds a predetermined threshold; and
recording, by the call recording function of the computer, an audio of the phone call.
8. The computer-implemented method of claim 7 , wherein the carrier signaling data is in at least one of a CAP, a MAP, an SS7, and an API message.
9. The computer-implemented method of claim 7 , further comprising:
retrieving, by the computer, the stored carrier signaling data utilizing a correlation identifier in the received carrier signaling data.
10. A computer-implemented method, comprising:
receiving, by a computer, second carrier signaling data of an incoming phone call from a second switching device in a telephone network;
retrieving, by the computer, first carrier signaling data at a first switching device of the phone call;
generating, by the computer, a threat score of the incoming phone call based upon comparing the second carrier signaling data with the first carrier signaling data; and
transmitting, by the computer, the threat score to a device associated with a callee of the incoming phone call.
11. The computer-implemented method of claim 10 , wherein the first carrier signaling data is in at least one of a CAP, a MAP, an SS7, and an API message.
12. The computer-implemented method of claim 10 , wherein the first switching device is an originating switching device of the phone call in the telephone network.
13. The computer-implemented method of claim 12 , wherein the first carrier signaling data is a real-time carrier signaling data received at the originating switching device.
14. The computer-implemented method of claim 10 , wherein the second switching device is a terminating switching device of the phone call in the telephone network.
15. The computer-implemented method of claim 14 , further comprising:
transmitting, by the computer, an originating status message to the terminating switching device.
16. The computer-implemented method of claim 15 , wherein the originating status message is at least one of route select failure, O_Called_Party_Busy, O_No_Answer, O_Answer, O_Disconnect, and O_Abandon.
17. The computer-implemented method of claim 10 , further comprising:
storing, by the computer, the first carrier signaling data in association with a correlation identifier;
in response to the computer receiving the second carrier signaling data:
parsing, by the computer, the second carrier signaling data to extract the correlation identifier; and
retrieving, by the computer, first carrier signaling data utilizing the extracted correlation identifier.
18. The computer-implemented method of claim 10 , wherein the first and the second switching devices are intermediate switching devices of the telephone network.
19. The computer-implemented method of claim 10 , further comprising:
transmitting, by the computer, the threat score to the device associated with the callee prior to the ringing of the incoming phone call.
20. The computer-implemented method of claim 10 , wherein at least one of the first and second carrier signaling data includes billing data.