Caller verification via carrier metadata

Patent metadata

Field	Value
Publication number	US-11470194-B2
Application number	US-202016992789-A
Country	US
Kind code	B2
Filing date	Aug 13, 2020
Priority date	Aug 19, 2019
Publication date	Oct 11, 2022
Grant date	Oct 11, 2022

Abstract

Embodiments described herein provide for passive caller verification and/or passive fraud risk assessments for calls to customer call centers. Systems and methods may be used in real time as a call is coming into a call center. An analytics server of an analytics service looks at the purported Caller ID of the call, as well as the unaltered carrier metadata, which the analytics server then uses to generate or retrieve one or more probability scores using one or more lookup tables and/or a machine-learning model. A probability score indicates the likelihood that information derived using the Caller ID information has occurred or should occur given the carrier metadata received with the inbound call. The one or more probability scores be used to generate a risk score for the current call that indicates the probability of the call being valid (e.g., originated from a verified caller or calling device, non-fraudulent).

First claim

What is claimed is:

1. A computer-implemented method for caller verification, the method comprising:
receiving, by a computer, purported carrier metadata for a current call originated at a calling device;
receiving, by the computer from an analytics database, probability data for derived metadata based upon one or more types of values of the purported carrier metadata, wherein the derived metadata is generated using the one or more types of the values of carrier metadata, wherein the probability data indicates a probability of occurrence of values of the derived metadata with respect to the values in the carrier metadata, and wherein at least one type of carrier metadata value indicates at least one of: Jurisdiction Information Parameter (JIP), Originating Line Information (OLI), P-Asserted-Identity, an originating switch, an originating trunk, and Caller ID;
generating, by the computer, one or more probability scores for the current call based upon the probability data, the values of the derived metadata, and the values of the purported carrier metadata, wherein the probability data comprises one or more probability lookup tables, each respective lookup table indicating a distribution percentage that each of the values of the derived metadata corresponds to each of the values of carrier metadata; and
generating, by the computer, a risk score for the current call based upon the one or more probability scores associated with the current call.

2. The method according to claim 1 , further comprising verifying, by the computer, the calling device in response to determining that the risk score satisfies a verification threshold that the carrier metadata for the current call is associated with a verified calling device.

3. The method according to claim 1 , further comprising detecting, by the computer, the current call as fraudulent in response to determining that the risk score satisfies a fraud threshold.

4. The method according to claim 1 , further comprising retrieving, by the computer, from a telephony database the derived metadata associated with a purported caller identifier (Caller ID) in the carrier metadata received with the current call.

5. The method according to claim 1 , wherein at least one derived metadata value indicates at least one of: a carrier, a geographic location, and a line type.

6. The method according to claim 1 , further comprising updating, by the computer a probability lookup table for derived metadata based upon values of corresponding metadata received from a records database.

7. The method according to claim 1 , wherein the probability data comprises one or more feature vectors associated with the current call, each feature vector indicating a probability of occurrence of the values of the carrier metadata and the values of derived metadata, the method further comprising:
applying, by the computer, a trained machine-learning model to the one or more feature vectors generated for the current call to generate the risk score for the current call.

8. The method according to claim 7 , wherein at least one database configured to store feature vectors for a plurality of calls, and wherein each call is associated with a label indicating the call is fraudulent or non-fraudulent, the method further comprising:
applying, by the computer, a machine-learning model to the feature vectors of the plurality of calls identified as fraudulent and to the feature vectors of the plurality of calls identified as non-fraudulent to generate the trained machine-learning model.

9. The method according to claim 8 , further comprising:
selecting, by the computer, from a records database call data for two or more prior calls, wherein the computer selects carrier metadata for a first prior call and derived metadata for a second prior call; and
generating, by the computer, synthetic call data for a synthetic call, the synthetic call data comprising the carrier metadata of the first prior call, the derived metadata of the second prior call, and a second label indicating the synthetic call data is fraudulent, wherein the machine-learning model is trained using the prior call data in a records database and the synthetic call data.

10. A system comprising:
an analytics database comprising a non-transitory storage medium configured to store probability data for derived metadata, wherein the derived metadata is generated using one or more types of values of carrier metadata, wherein the probability data indicates a probability of occurrence of values of the derived metadata with respect to the values in the carrier metadata, and wherein the probability data comprises one or more probability lookup tables, each respective lookup table indicating a distribution percentage that each of the values of the derived metadata corresponds to each of the values of the carrier metadata; and
a server comprising a processor configured to:
receive purported carrier metadata for a current call originated at a calling device;
receive, from the analytics database, the probability data for the derived metadata based upon based upon one or more types of values of the purported carrier metadata, wherein at least one type of carrier metadata value indicates at least one of: Jurisdiction Information Parameter (JIP), Originating Line Information (OLI), P-Asserted-Identity, an originating switch, an originating trunk, and Caller ID;
generate one or more probability scores for the current call based upon the probability data, the values of the derived metadata, and the values of the purported carrier metadata; and
generate a risk score for the current call based upon the one or more probability scores associated with the current call.

11. The system according to claim 10 , wherein the server is further configured to verify the calling device in response to determining that the risk score satisfies a verification threshold that the carrier metadata for the current call is associated with a verified calling device.

12. The system according to claim 10 , wherein the server is further configured to detect the current call as fraudulent in response to determining that the risk score satisfies a fraud threshold.

13. The system according to claim 10 , wherein the server is further configured to retrieve from a telephony database the derived metadata associated with a purported caller identifier (Caller ID) in the carrier metadata received with the current call.

14. The method according to claim 10 , wherein the server is further configured to update a probability lookup table for derived metadata based upon values of corresponding metadata received from a records database.

15. The system according to claim 10 , wherein the probability data comprises one or more feature vectors associated with the current call, each feature vector indicating a probability of occurrence of the values of carrier metadata and the values of derived metadata; and
wherein the server is further configured to apply a trained machine-learning model to the one or more feature vectors generated for the current call to generate the risk score for the current call.

16. The system according to claim 15 , wherein at least one database is configured to store feature vectors for a plurality of calls, and wherein each call is associated with a label indicating the call is fraudulent or non-fraudulent; and
wherein the server is further configured to apply a machine-learning model to the feature vectors of the plurality of calls identified as fraudulent and to the feature vectors of the plurality of calls identified as non-fraudulent to generate the trained machine-lear

Assignees

• Pindrop Security Inc

Inventors

• Cornwell John
• Nelms Ii Terry

Classifications

• H04M3/2281 Primary

  Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls · CPC title

• H04M3/5175 Primary

  Call or contact centers supervision arrangements · CPC title

• G06F18/241

  relating to the classification model, e.g. parametric or non-parametric approaches · CPC title

• G06F18/214

  Generating training patterns; Bootstrap methods, e.g. bagging or boosting · CPC title

• H04M2203/6027

  Fraud preventions · CPC title