Determining usage predictions and detecting anomalous user activity through traffic patterns
A system for selecting and monitoring data plans for telecommunications systems, and methods of determining, learning and estimating usage patterns in-order to predict usage and tie this to cost and the overlaying of plan selection for cost optimization. Further, additional methods are applied to determine anomalous user behaviors and raise security and data leakage related events.
1. A method of using a computer to detect anomalies in the data traffic of a mobile device, the computer performing the steps of:
collecting from the mobile device, usage data relating to data usage for the mobile device for a given time period;
setting threshold values based at least in part on a mobile device data plan and an amount of data used by the mobile device within a set time period and on historical usage data of the mobile device, where the weighting afforded the historical usage data is related to the amount of stored history;
comparing the usage data against the threshold values;
identifying an anomaly if a statistic of the usage data exceeds a corresponding threshold of the threshold values;
updating the threshold values based on a running average of each statistic of the usage data;
the computer further performing the steps of:
saving existing usage data or predicted data or both;
generating a graphical user interface including at least one statistic of the usage data;
overlaying at least one statistic of the existing usage data or predicted data or both onto the at least one statistic of the usage data.
2. The method of claim 1 , wherein the weighting afforded the historical usage data increases as the amount of stored history increases up to a maximum weighted percentage for the historical usage data.
3. The method of claim 1 , wherein the step of updating the threshold values based on a running average of each statistic of the usage data is based on formula I,
T
0
=
T
0
+
Max
[
T
0
×
Δ
max
100
,
T
0
-
(
∑
i
=
1
N
T
i
-
Max
(
T
1
,
…
,
T
N
)
)
N
-
1
]
wherein T 0 is a current threshold value;
Δ max is the maximum change of the threshold value, expressed as a percentage;
T i is the value of a corresponding data traffic statistic i time periods prior to the current period; and
N is the number of time periods used to compute the updated threshold.
4. The method of claim 3 , wherein Δ max is 10 and N is 12.
5. The method of claim 1 , wherein the given time period corresponds to a data plan period.
6. The method of claim 1 , wherein the collecting step comprises:
reading, at a first interval, data traffic statistics from a network interface on the mobile device;
adding the data traffic statistics to running totals on the mobile device.
7. The method of claim 6 , wherein the collecting step further comprises:
when the running totals exceed a delivery threshold,
sending the running totals to the server; and
adjusting the running totals.
8. The method of claim 1 , wherein the collecting step further comprises:
when a delivery timer expires,
sending the running totals to the server; and
adjusting the running totals.
9. The method of claim 1 , wherein threshold values include a data limit for the given time period.
10. The method of claim 1 , the computer further performing the steps of:
extrapolating data traffic statistics to the end of the given time period;
if a statistic of the extrapolated data traffic statistics exceeds a corresponding threshold value of the threshold values, flagging an anomaly.