System and method for real time fraud analysis of communications data
A telecommunications service provider's real time analysis system analyzes communications data to detect potentially fraudulent communications data, where the analysis is performed in real time in the routing path of the communications data. The communications data may include calls (e.g., SS7, VoIP, etc. based calls) and messages (e.g., SMS, MMS, etc.). The real time analysis system rejects potentially fraudulent communications data and non-fraudulent communications data in order to be used in real time in the routing path of the communications data. A rejection by the real time analysis system may cause non-fraudulent communications data to still be sent to the intended destination of the communications data. The real time analysis system can be in the routing path of the communications data without further routing non-fraudulent communications data traffic to the next appropriate hop in the routing path.
1. A telecommunications system comprising:
a processor; and
a memory device that stores a plurality of instructions, which when executed by the processor, causes the processor to:
receive a request from a server to route communications data, the communications data including a plurality of communications attributes;
analyze the communications data to determine if at least one of the plurality of communications attributes associated with the communications data is on a blacklist;
if at least one of the plurality of communications attributes associated with the communications data is on the blacklist, generate a first rejection message, where the first rejection message would cause the communications data to be blocked from further routing;
if none of the plurality of communications attributes associated with the communications data are on the blacklist, generate a second rejection message, where the second rejection message would cause the communications data to be blocked from further routing; and
transmit the first rejection message or the second rejection message to the server;
wherein if the second rejection message is sent, then the second rejection message causes the server to route the communications data to another server to deliver the communications data, and
wherein the communications data is call signaling associated with a voice call and the at least one of the plurality of communications attributes is a country code.
2. The telecommunications system of claim 1 , wherein if at least one of the plurality of communications attributes associated with the communications data is on the blacklist, flag the communications data as fraudulent.
3. The telecommunications system of claim 2 , wherein the processor further analyzes the flagged communications data to determine if the at least one of the plurality of communications attributes associated with the communications data is on a whitelist.
4. The telecommunications system of claim 3 , wherein if the at least one of the plurality of communications attributes associated with the communications data is on the whitelist, generate the second rejection message.
5. The telecommunications system of claim 1 , wherein the second rejection message is a session initiation protocol 503 service unavailable message.
6. The telecommunications system of claim 1 , wherein the second rejection message is an SS7 release 34 message.
7. The telecommunications system of claim 1 , wherein the first rejection message is a session initiation protocol 403 forbidden message SS7 release 34 message.
8. The telecommunications system of claim 1 , wherein the first rejection message is an SS7 release 21 message.
9. A method of operating a telecommunications system comprising:
receiving, with a processor, a request from a server to route communications data, the communications data including a plurality of communications attributes;
analyzing, with the processor, the communications data to determine if at least one of the plurality of communications attributes associated with the communications data is on a blacklist;
if at least one of the plurality of communications attributes associated with the communications data is on the blacklist, generating with the processor, a first rejection message, where the first rejection message would cause the communications data to be blocked from further routing;
if none of the plurality of communications attributes associated with the communications data are on the blacklist, generating with the processor, a second rejection message, where the second rejection message would cause the communications data to be blocked from further routing; and
transmitting, with the processor, the first rejection message or the second rejection message to the server;
wherein if the second rejection message is sent, then the second rejection message causes the server to route the communications data to another server to deliver the communications data, and
wherein the communications data is call signaling associated with a voice call and the at least one of the plurality of communications attributes is a country code.
10. The method of claim 9 , wherein if at least one of the plurality of communications attributes associated with the communications data is on the blacklist, further comprising flagging the communications data as fraudulent.
11. The method of claim 10 , further comprising analyzing the flagged communications data to determine if the at least one of the plurality of communications attributes associated with the communications data is on a whitelist.
12. The method of claim 11 , wherein if the at least one of the plurality of communications attributes associated with the communications data is on the whitelist, further comprising generating the second rejection message.