Fraud detection in interactive voice response systems
Systems and methods for call detail record (CDR) analysis to determine a risk score for a call and identify fraudulent activity and for fraud detection in Interactive Voice Response (IVR) systems. An example method may store information extracted from received calls. Queries of the stored information may be performed to select data using keys, wherein each key relates to one of the received calls, and wherein the queries are parallelized. The selected data may be transformed into feature vectors, wherein each feature vector relates to one of the received calls and includes a velocity feature and at least one of a behavior feature or a reputation feature. A risk score for the call may be generated during the call based on the feature vectors.
1. A computer-implemented method comprising:
obtaining, by a computer, call data for an incoming call indicating a source automatic number identification (ANI) and one or more user accounts corresponding to the source ANI in the call data for the incoming call;
extracting during the incoming call, by the computer, one or more features for the incoming call using the call data for the incoming call;
extracting during the incoming call, by the computer, a feature vector for the incoming call based upon the one or more features extracted using the call data for the incoming call; and
generating, by the computer, a risk score for the incoming call by executing a machine learning model on the feature vector generated for the incoming call, the machine learning model trained on the call data of a plurality of past calls, a plurality of source ANIs, and a plurality of user accounts corresponding to the plurality of source ANIs.
2. The method according to claim 1 , wherein obtaining the call data for the incoming call includes:
receiving, by a computer, a plurality of timestamps and corresponding interaction steps with an interactive voice response (IVR) system during the incoming call.
3. The method according to claim 1 , wherein extracting the feature vector includes:
generating, by the computer, one or more velocity features for the source ANI based upon the call data for the incoming call.
4. The method according to claim 3 , wherein extracting a velocity feature includes:
determining, by the computer, a number of accounts associated with the source ANI.
5. The method according to claim 3 , wherein extracting a velocity feature includes:
determining, by the computer, a number of destination ANIs associated with the source ANI.
6. The method according to claim 1 , wherein generating the feature vector includes:
extracting, by the computer, a behavior feature for the incoming call based upon the plurality of timestamps and corresponding interaction steps with an IVR system during the incoming call, wherein the feature vector is generated based upon the behavior feature.
7. The method according to claim 1 , further comprising:
obtaining, by the computer, the call data for a plurality of prior calls, the call data for the plurality of prior calls indicating the source ANI for the prior call and one or more user accounts associated with the source ANI; and
training, by the computer, the machine learning model based upon the call data for the plurality of calls indicating each source ANI and the one or more user accounts associated with the source ANI.
8. The method according to claim 7 , further comprising:
receiving, by the computer, user feedback for the plurality of prior calls, the user feedback including an ANI-label pair for each prior call;
training, by the computer, the machine learning model based upon the call data for the plurality of calls and the ANI-label pairs for the plurality of prior calls.
9. The computer-implemented method of claim 1 , further comprising triggering, by the computer, a computer operation based upon the risk score of the incoming call.
10. The computer-implemented method of claim 9 , wherein the triggered computer operation comprises at least one of displaying the risk score on a computer display of an IVR system and disabling a feature in the IVR system.
11. The method according to claim 3 , wherein, when extracting the feature vector, the processor is further configured to:
determine a number of accounts associated with the source ANI.
12. A system comprising:
one or more network interfaces configured to receive call data for one or more incoming calls; and
a computing device comprising processor configured to:
obtain call data for an incoming call indicating a source automatic number identification (ANI) and one or more user accounts corresponding to the source ANI in the call data for the incoming call;
extract, during the incoming call, one or more features for the incoming call using the call data for the incoming call;
extract, during the incoming call, a feature vector for the incoming call based upon the one or more features extracted using the call data for the incoming call; and
generate a risk score for the incoming call by executing a machine learning model on the feature vector generated for the incoming call, the machine learning model trained on the call data of a plurality of past calls, a plurality of source ANIs, and a plurality of user accounts corresponding to the plurality of source ANIs.
13. The system according to claim 12 , wherein, when obtaining the call data for the incoming call, the processor is further configured to:
receive a plurality of timestamps and corresponding interaction steps with an interactive voice response (IVR) system during the incoming call.
14. The system according to claim 12 , wherein, when extracting the feature vector, the processor is further configured to:
extracting, by the computer, one or more velocity features for the source ANI based upon the call data for the incoming call.
15. The system according to claim 14 , wherein, when extracting the feature vector, the processor is further configured to:
determine a number of destination ANIs associated with the source ANI.
16. The system according to claim 12 , wherein, when generating the feature vector, the processor is further configured to:
extract a behavior feature for the incoming call based upon the plurality of timestamps and corresponding interaction steps with an IVR system during the incoming call, wherein the feature vector is generated based upon the behavior feature.
17. The system according to claim 12 , wherein the processor is further configured to:
obtain the call data for a plurality of prior calls, the call data for the plurality of prior calls indicating the source ANI for the prior call and one or more user accounts associated with the source ANI; and
train the machine learning model based upon the call data for the plurality of calls indicating each source ANI and the one or more user accounts associated with the source ANI.
18. The system according to claim 17 , the processor is further configured to:
receive user feedback for the plurality of prior calls, the user feedback including an ANI-label pair for each prior call;
train the machine learning model based upon the call data for the plurality of calls and the ANI-label pairs for the plurality of prior calls.
19. The system according to claim 12 , wherein the processor is further configured to:
trigger a computer operation based upon the risk score of the incoming call.
20. The system according to claim 19 , wherein the triggered computer operation comprises at least one of displaying the risk score on a computer display of an IVR system and disabling a feature in the IVR system.