Call classification through analysis of DTMF events

Patent metadata

Field	Value
Publication number	US-10257591-B2
Application number	US-201715600625-A
Country	US
Kind code	B2
Filing date	May 19, 2017
Priority date	Aug 2, 2016
Publication date	Apr 9, 2019
Grant date	Apr 9, 2019

Abstract

Systems, methods, and computer-readable media for call classification and for training a model for call classification, an example method comprising: receiving DTMF information from a plurality of calls; determining, for each of the calls, a feature vector including statistics based on DTMF information such as DTMF residual signal comprising channel noise and additive noise; training a model for classification; comparing a new call feature vector to the model; predicting a device type and geographic location based on the comparison of the new call feature vector to the model; classifying the call as spoofed or genuine; and authenticating a call or altering an IVR call flow.

First claim

What is claimed is:

1. A computer-implemented method to classify a call, the computer-implemented method comprising:
receiving dual-tone multifrequency (DTMF) information from a call;
determining a DTMF residual signal of the call based on the DTMF information;
determining a feature vector based on the DTMF information, wherein at least one feature in the feature vector is based on the DTMF residual signal;
comparing the feature vector to a model; and
classifying the call based on the comparison of the feature vector to the model.

2. computer-implemented method of claim 1 , further comprising:
prompting, by an Interactive Voice Response (IVR) system, entry of the DTMF information.

3. The computer-implemented method of claim 1 , further comprising:
determining an ideal DTMF tone, wherein the determining the feature vector based on the DTMF information includes determining a feature based on the ideal DTMF tone.

4. The computer-implemented method of claim 1 , further comprising:
estimating channel noise in a DTMF tone, wherein the determining the feature vector based on the DTMF information includes determining a feature based on the channel noise.

5. The computer-implemented method of claim 1 , further comprising:
estimating additive noise in a DTMF tone, wherein the determining the feature vector based on the DTMF information includes determining a feature based on the additive noise.

6. The computer-implemented method of claim 1 , wherein the feature vector is a vector of features including at least one feature, and wherein the at least one feature is based on at least one of a mean, a median, a variance, a standard deviation, a frequency, a wavelength, a duration, a coefficient of variation, or a percentile of DTMF information.

7. The computer-implemented method of claim 1 , further comprising: receiving DTMF information from a far end of the call.

8. The computer-implemented method of claim 7 , wherein the receiving DTMF information from the call is done by an Interactive Voice Response (IVR) system at a near end of the call.

9. The computer-implemented method of claim 1 , wherein the classifying the call based on the comparison of the feature vector to the model includes predicting, based on the comparison of the feature vector to the model, a device type of a device that provides the DTMF information, wherein the computer-implemented method further comprises:
comparing the predicted device type to an expected device type associated with a phone number of the call.

10. The computer-implemented method of claim 9 , further comprising:
classifying the call as spoofed based on the comparison of the predicted device type to the expected device type.

11. The computer-implemented method of claim 9 , further comprising:
authenticating at least one of the call or a party to the call based on the comparison of the predicted device type to the expected device type.

12. The computer-implemented method of claim 1 , wherein the classifying the call based on the comparison of the feature vector to the model includes predicting, based on the comparison of the feature vector to the model, a relative geographic location of a party to the call, wherein the computer-implemented method further comprises:
comparing the predicted relative geographic location of the party to the call to an expected geographic location associated with a phone number of the call.

13. The computer-implemented method of claim 12 , further comprising:
classifying the call as spoofed based on the comparison of the relative geographic location of the party to the call to the expected geographic location.

14. The computer-implemented method of claim 12 , further comprising:
authenticating at least one of the call or a party to the call based on the comparison of the relative geographic location of the party to the call to the expected geographic location.

15. A computer-implemented method to train a model for call classification, the computer-implemented method comprising:
receiving dual-tone multifrequency (DTMF) information from a plurality of calls;
determining, for each of the calls, a DTMF residual signal of the call based on the DTMF information of the call;
determining, for each of the calls, a feature vector based on the DTMF residual signal of the call; and
training a model on the feature vectors.

16. The computer-implemented method of claim 15 , wherein the DTMF information from each of the calls is from a same phone number, the method further comprising:
receiving DTMF information from a new call;
determining a new call feature vector based on the DTMF information from the new call;
comparing the new call feature vector to the model; and
predicting, based on the comparison of the new call feature vector to the model, the new call as having a same device type as a device type of the plurality of calls.

17. The computer-implemented method of claim 15 , wherein the plurality of calls includes genuine calls and spoofed calls, the method further comprising:
receiving DTMF information from a new call;
determining a new call feature vector based on the DTMF information from the new call;
comparing the new call feature vector to the model; and
predicting, based on the comparison of the new call feature vector to the model, the new call as genuine or spoofed.

18. The computer-implemented method of claim 15 , wherein the feature vector is a vector of features including at least one feature, and wherein the at least one feature is based on at least one of a mean, a median, a variance, a standard deviation, a frequency, a wavelength, an amount of time, a coefficient of variation, or a percentile of DTMF information.

19. The computer-implemented method of claim 15 , wherein the plurality of calls are each from a same device type, the method further comprising:
receiving DTMF information from a new call;
determining a new call feature vector based on the DTMF information from the new call;
comparing the new call feature vector to the model; and
predicting, based on the comparison of the new call feature vector to the model, the new call as having the same device type as the device type of the plurality of calls.

20. The computer-implemented method of claim 19 , wherein the predicting, based on the comparison of the new call feature vector to the model, the new call as having the same device type as the device type of the plurality of calls includes:
estimating a probability that the new call has the same device type as the device type of the plurality of calls.

21. The computer-implemented method of claim 15 , wherein the plurality of calls are from a same device, the method further comprising:
receiving DTMF information from a new call;
determining a new call feature vector based on the DTMF information from the new call;
comparing the new call feature vector to the model; and
predicting, based on the comparison of the new call feature vector to the model, a device of the new call is the same device.

22. The computer-implemented method of claim 21 , wherein at least one of the device of the plurality of calls or a party to the plurality of calls is authenticated before providing DTMF information.

23. The computer-implemented method of claim 22 , wherein at least one of the device of the new call or a party to the new call is authenticated based on the comparison of the new call feature vector to the model.

24. The compute

Assignees

• Pindrop Security Inc

Inventors

• Gaubitch Nick
• Strong Scott
• Cornwell John
• Kingravi Hassan
• Dewey David

Classifications

• H04Q1/45

  using multi-frequency signalling (H04Q1/46 takes precedence) · CPC title

• H04M7/1295

  Details of dual tone multiple frequency signalling · CPC title

• H04Q2213/13139

  Fraud detection/prevention · CPC title

• H04Q3/70 Primary

  Identification of class of calling subscriber · CPC title

• H04Q2213/13515

  authentication, authorisation - fraud prevention · CPC title