Systems and methods for detecting call provenance from call audio
Various embodiments of the invention are detection systems and methods for detecting call provenance based on call audio. An exemplary embodiment of the detection system can comprise a characterization unit, a labeling unit, and an identification unit. The characterization unit can extract various characteristics of networks through which a call traversed, based on call audio. The labeling unit can be trained on prior call data and can identify one or more codecs used to encode the call, based on the call audio. The identification unit can utilize the characteristics of traversed networks and the identified codecs, and based on this information, the identification unit can provide a provenance fingerprint for the call. Based on the call provenance fingerprint, the detection system can identify, verify, or provide forensic information about a call audio source.
1. A computer-implemented method comprising:
obtaining, by a computer, call data for a call originated at a calling device of a caller, the call data including audio data and indicating one or more characteristics associated with the calling device;
extracting, by the computer, a feature vector using the one or more characteristics associated with the calling device from the call data, the one or more characteristics including at least one of a network or a location associated with the calling device;
generating, by the computer, a risk score associated with the call based upon comparing the feature vector for the one or more characteristics associated with the calling device extracted for the call data against a stored feature vector for one or more stored characteristics stored in one or more databases using a machine learning model trained to generate the risk score based upon training feature vectors from training call data.
2. The method according to claim 1 , further comprising authorizing, by the computer, the call data, in response to the computer determining that the one or more characteristics for the call data satisfies a matching threshold to the one or more stored characteristics.
3. The method according to claim 1 , further comprising obtaining, by the computer, the one or more stored characteristics associated with a registered user from enrollment call data of one or more enrollment calls to generate the one or more stored characteristics for the registered user.
4. The method according to claim 3 , wherein the one or more stored characteristics associated with the registered indicates at least one of: a registered telecommunications device, one or more expected locations, one or more expected networks, one or more codecs, or the registered user.
5. The method according to claim 1 , further comprising obtaining, by the computer, the one or more stored characteristics associated with a fraudster from prior call data of prior fraud call to generate the one or more stored characteristics for the fraudster in a blacklist in the one or more databases.
6. The method according to claim 5 , wherein the computer determines the risk score based upon a similarity between the one or more characteristics associated with the calling device and the one or more stored characteristics for the fraudster in the blacklist.
7. The method according to claim 1 , further comprising identifying, by the computer, a unique telecommunications device involved in the call based on the one or more characteristics.
8. The method according to claim 1 , further comprising identifying, by the computer, at least a portion of one or more networks of a transmission path of the call based on the one or more characteristics extracted from call data.
9. The method according to claim 1 , further comprising receiving, by the computer, metadata associated with the call for at least a portion of the call data of the call.
10. The method according to claim 9 , wherein the computer compares the metadata against at least a portion of the stored one or more characteristics.
11. A system comprising:
a computer comprising at least one processor configured to:
obtain call data for a call originated at a calling device of a caller, the call data including audio data and indicating one or more characteristics associated with the calling device;
extract a feature vector using the one or more characteristics associated with the calling device from the call data, the one or more characteristics including at least one of a network or a location associated with the calling device; and
generate a risk score associated with the call based upon comparing the feature vector for the one or more characteristics associated with the calling device extracted for the call data against a stored feature vector for one or more stored characteristics stored in one or more databases using a machine learning model trained to generate the risk score based upon training feature vectors from training call data.
12. The system according to claim 11 , wherein the computer is further configured to authorize the call data, in response to the computer determining that the one or more characteristics for the call data satisfies a matching threshold to the one or more stored characteristics.
13. The system according to claim 11 , wherein the computer is further configured to extract the one or more stored characteristics associated with a registered user from enrollment call data of one or more enrollment calls to generate the one or more stored characteristics for the registered user.
14. The system according to claim 13 , wherein the one or more stored characteristics associated with the registered indicates at least one of: a registered telecommunications device, one or more expected locations, one or more expected networks, one or more codecs, or the registered user.
15. The system according to claim 11 , wherein the computer is further configured to obtain the one or more stored characteristics associated with a fraudster from prior call data of prior fraud call to generate the one or more stored characteristics for the fraudster in a blacklist in the one or more databases.
16. The system according to claim 15 , wherein the computer determines the risk score based upon a similarity between the one or more characteristics associated with the calling device and the one or more stored characteristics for the fraudster in the blacklist.
17. The system according to claim 11 , wherein the computer is further configured to identify a unique telecommunications device involved in the call based on the one or more characteristics.
18. The system according to claim 11 , wherein the computer is further configured to identify at least a portion of one or more networks of a transmission path of the call based on the one or more characteristics extracted from call data.
19. The system according to claim 11 , wherein the computer is further configured to receive metadata associated with the call for at least a portion of the call data of the call.
20. The system according to claim 19 , wherein the computer compares the metadata against at least a portion of the stored one or more characteristics.