Method and apparatus for threat identification through analysis of communications signaling, events, and participants
Aspects of the invention determining a threat score of a call traversing a telecommunications network by leveraging the signaling used to originate, propagate and terminate the call. Outer-edge data utilized to originate the call may be analyzed against historical, or third party real-time data to determine the propensity of calls originating from those facilities to be categorized as a threat. Storing the outer edge data before the call is sent over the communications network permits such data to be preserved and not subjected to manipulations during traversal of the communications network. This allows identification of threat attempts based on the outer edge data from origination facilities, thereby allowing isolation of a compromised network facility that may or may not be known to be compromised by its respective network owner. Other aspects utilize inner edge data from an intermediate node of the communications network which may be analyzed against other inner edge data from other intermediate nodes and/or outer edge data.
1. A computer-implemented method for analyzing call signaling data, the method comprising:
obtaining, by a computer from one or more databases, prior signaling data associated with one or more prior calling devices for a plurality of prior calls, the prior signaling data associated with the prior calling device including a device identifier of the prior calling device;
receiving, by the computer from an originating carrier, inbound signaling data associated with an inbound calling device that originated an inbound call traversing a telecommunications network and not in the plurality of prior calls, the inbound signaling data including the device identifier associated with the inbound calling device;
generating, by the computer, statistical information using the prior signaling data associated with the prior calling device having the device identifier matching the device identifier of the inbound calling device;
identifying, by the computer, one or more outliers in the inbound signaling data based upon the statistical information generated for the prior calling device having the device identifier of the inbound calling device;
generating, by the computer, a threat score for the inbound phone call based at least in part upon the one or more outliers indicating a difference between the inbound signaling data and the statistical information generated using the prior signaling data; and
transmitting, by the computer, instructions to one or more carriers to direct the inbound phone call based upon the threat score.
2. The method according to claim 1 , wherein a carrier is at least one of the originating carrier and an intermediate carrier.
3. The method according to claim 1 , wherein the prior signaling data for the prior call further includes prior line information for associated with the prior calling device, and
wherein the threat score is further based upon one or more differences between the inbound signaling data and the prior signaling data of at least one prior call.
4. The method according to claim 1 , wherein the one or more databases includes a database of a terminating carrier, and wherein the method further comprises:
receiving, by the computer from the database of the terminating carrier, the prior signaling data of the prior calling device having the device identifier matched to the inbound calling device,
wherein the threat score is further based upon one or more differences between the inbound signaling data received from the originating carrier and the prior signaling data received from the terminating carrier.
5. The method according to claim 1 , wherein at least one database of the one or more databases includes a database of a carrier system.
6. The method according to claim 1 , wherein at least one database of the one or more databases includes a database of a third-party non-carrier system.
7. The method according to claim 1 , wherein an outlier includes at least one of: a time of the inbound call, one or more instances of repeat calling, a location anomaly, or an ownership status.
8. The method according to claim 1 , wherein the device identifier includes at least one of: a subscriber identifier, an equipment identifier, or a subscriber identification module (SIM) card.
9. The method according to claim 1 , further comprising determining, by the computer, whether the threat score for the inbound call satisfies an authentication threshold.
10. The method according to claim 9 , further comprising authenticating, by the computer, the inbound calling device in response to determining that the threat score satisfies the authentication threshold.
11. The method according to claim 9 , further comprising executing, by the computer, one or more remedial actions in response to determining that the threat score fails to satisfy the authentication threshold.
12. A computer-implemented method for analyzing call signaling data, the method comprising:
receiving, by a computer of a network platform associated with an intermediate network system, inbound signaling data associated with an inbound calling device for an inbound call from an originating carrier;
obtaining, by the computer, expected signaling data associated with the inbound calling device from one or more databases of one or more network carrier systems;
determining, by the computer, an amount of variance between the expected signaling data and the inbound signaling data for the inbound calling device, wherein the computer determines the level of variance based upon the expected signaling data received from a terminating carrier and the inbound signaling data from the originating carrier;
generating, by the computer, a threat score for the inbound call based at least in part upon the amount of variance between the inbound signaling data and the expected signaling data obtained from the one or more databases of the one or more network carrier systems; and
responsive to determining that the threat score for the inbound call fails satisfy an authentication threshold, executing, by the computer, one or more remedial actions.
13. The method according to claim 12 , wherein obtaining the expected signaling data includes:
generating, by the computer, statistical information for the expected signaling data based upon prior signaling data associated with one or more prior calling devices,
wherein the computer determines the amount of variance between the expected signaling data and the inbound signaling data for the inbound calling device using the statistical information.
14. The method according to claim 12 , wherein obtaining the expected signaling data includes:
identifying, by the computer, one or more types of data fields in the expected signaling data, the one or more types of data fields associated with one or more intermediate carriers,
wherein the computer determines the amount of variance based upon the one or more types of data fields in the expected signaling data and the one or more types of data fields in the inbound signaling data.
15. The method according to claim 12 , wherein a database of a network carrier system includes at least one of: the database of an intermediate carrier, the database of the originating carrier, or the database of the terminating carrier.
16. The method according to claim 12 , wherein the computer further obtains at least a portion of the expected signaling data associated with the inbound calling device from a database of a third-party non-carrier system.
17. The method according to claim 16 , further comprising transmitting, by the computer, a request for the expected signaling data associated with the inbound calling device to the third-party non-carrier system, wherein the request includes a device identifier associated with the inbound calling device received in the inbound signaling data.
18. The method according to claim 12 , wherein the inbound signaling data includes at least one of: a device identifier associated with the inbound calling device or inbound line information associated with the inbound calling device.
19. The method according to claim 12 , wherein a remedial action of the one or more remedial actions includes at least one of: dropping the inbound call, routing the inbound call for isolation, or transmitting a notification to one or more devices of the one or more network carrier systems.
20. The method according to claim 12 , wherein the computer determines the level of variance between the expected signaling data received from the terminating carrier having a comparatively higher-level trust and the inbound signaling data from the originating carrier having a comparatively lower-level trust.