Systems and methods of gateway detection in a telephone network
Embodiments described herein provide for detecting whether an Automatic Number Identification (ANI) associated with an incoming call is a gateway, according to rules-based models and machine learning models generated by the computer using call data stored in one or more databases.
1. A computer-implemented method for detecting gateways, the method comprising:
generating, by a computer, a plurality of features for a plurality of caller Automatic Number Identifications (ANIs) based upon call data associated with a plurality of phone calls involving the plurality of caller ANIs;
calculating, by the computer, a first gateway score for each respective caller ANI based upon a set of one or more features associated with the respective caller ANI in the plurality of features;
detecting, by the computer, that at least one caller ANI of the plurality of caller ANIs is a gateway ANI, in response to determining that the first gateway score for the gateway ANI is above a detection threshold, wherein the gateway ANI is allocated for use by a plurality of caller devices;
generating, by the computer, a feature vector of the caller ANI based upon the call data for a plurality of calls for the caller ANI, the feature vector comprising:
a number of calls from the caller ANI to each callee receiving a comparatively larger number of calls normalized by a calls threshold,
a number of calls from the caller ANI to each type of callee receiving the comparatively larger of calls normalized by the calls threshold,
a lowest interarrival interval between consecutive calls, and a network type of the caller ANI;
executing, by the computer, a machine learning model on each feature vector to determine whether the caller ANI is associated with the gateway ANI, according to a contamination factor, thereby generating a second gateway score; and
generating, by the computer, an indication that the caller ANI is associated with the gateway based upon the second gateway score for the caller ANI, the indication for the computer to authenticate an incoming phone call from the caller ANI.
2. The method of claim 1 , further comprising generating, by the computer, a combined gateway score for the caller ANI based on each gateway score for the caller ANI.
3. A computer-implemented method for detecting gateways, the method comprising:
generating, by a computer, one or more feature vectors for one or more caller Automatic Number Identifications (ANIs) based upon call data extracted for a plurality of calls to a plurality of callees of a plurality of types of callees, wherein each feature vector for each caller ANI is based upon:
a number of calls from the caller ANI to each of the callees receiving a comparatively larger number of calls normalized by a calls threshold,
a number of calls from the caller ANI to each type of callee receiving the comparatively larger number of calls,
a lowest interarrival interval between consecutive calls, and
a network type of the caller ANI;
generating, by the computer, for each respective caller ANI, a gateway score based upon an anomaly detection algorithm using the one or more feature vectors; and
detecting, by the computer, a gateway is associated with the caller ANI, in response to determining that the gateway score for the caller ANI satisfies a detection threshold.
4. The method of claim 3 , further comprising authenticating, by the computer, an incoming call associated with a second ANI based upon one or more call features associated with the incoming call, the one or more call features including the second ANI.
5. The method of claim 3 , authenticating, by the computer, an incoming call associated with the caller ANI based upon one or more call features associated with the incoming call, the one or more call features excluding the caller ANI.
6. The method of claim 3 , wherein the detection threshold is based on a relative distance of the gateway score from at least one other gateway score.
7. The method of claim 3 , wherein the call data for the plurality of calls is extracted according to a lookback window.
8. The method of claim 3 , further comprising:
generating, by the computer, a volume score for the one or more caller ANIs based upon the number of calls received from the caller ANI and normalized by the calls threshold;
generating, by the computer, a spread score for the caller ANI based upon a number of callees that called from the caller ANI contained in the call data and normalized by a callee threshold;
generating, by the computer, a call diversity score for the caller ANI, based upon a number of types of callees that called from the caller ANI; and
calculating, by the computer, a second gateway score for the caller ANI based upon the volume score, the spread score, and the call diversity score.
9. The method of claim 8 , further comprising generating, by the computer, a combined gateway score for the caller ANI based on each gateway score for the caller ANI.
10. A system comprising:
a memory storage configured to store software executable for analyzing call data; and
a processor configured, when executing the software of the memory storage, to:
generate one or more feature vectors for one or more caller Automatic Number Identifications (ANIs) based upon the call data extracted for a plurality of calls to a plurality of callees of a plurality of types of callees, wherein each feature vector for each caller ANI is based upon:
a number of calls from the caller ANI to each of the callees receiving a comparatively larger number of calls normalized by a calls threshold,
a number of calls from the caller ANI to each type of callee receiving the comparatively larger number of calls,
a lowest interarrival interval between consecutive calls, and
a network type of the caller ANI;
generate for each respective caller ANI, a gateway score based upon an anomaly detection algorithm using the one or more feature vectors; and
detect a gateway is associated with the caller ANI, in response to the processor determining that the gateway score for the caller ANI satisfies a detection threshold.
11. The system of claim 10 , wherein the processor is configured to authenticate an incoming call associated with a second ANI based upon one or more call features associated with the incoming call, the one or more call features including the second ANI.
12. The system of claim 10 , wherein the processor is configured to authenticate an incoming call associated with the caller ANI based upon one or more call features associated with the incoming call, the one or more call features excluding the caller ANI.
13. The system of claim 10 , wherein the detection threshold is based on a relative distance of the gateway score from at least one other gateway score.
14. The system of claim 10 , wherein the call data for the plurality of calls is extracted according to a lookback window.
15. The system of claim 10 , wherein the processor is configured to:
generate a volume score for the one or more caller ANIs based upon the number of calls received from the caller ANI and normalized by the calls threshold;
generate a spread score for the caller ANI based upon a number of callees that called from the caller ANI contained in the call data and normalized by a callee threshold;
generate a call diversity score for the caller ANI, based upon a number of types of callees that called from the caller ANI; and
calculate a second gateway score for the caller ANI based upon the volume score, the spread score, and the call diversity score.
16. The system of claim 15 , wherein the processor is configured to generate a combined gateway score for the caller ANI based on each gateway score for the caller ANI.