Fraud detection in interactive voice response systems

Patent metadata

Field	Value
Publication number	US-11748463-B2
Application number	US-202117157837-A
Country	US
Kind code	B2
Filing date	Jan 25, 2021
Priority date	Oct 14, 2015
Publication date	Sep 5, 2023
Grant date	Sep 5, 2023

Abstract

Systems and methods for call detail record (CDR) analysis to determine a risk score for a call and identify fraudulent activity and for fraud detection in Interactive Voice Response (IVR) systems. An example method may store information extracted from received calls. Queries of the stored information may be performed to select data using keys, wherein each key relates to one of the received calls, and wherein the queries are parallelized. The selected data may be transformed into feature vectors, wherein each feature vector relates to one of the received calls and includes a velocity feature and at least one of a behavior feature or a reputation feature. A risk score for the call may be generated during the call based on the feature vectors.

First claim

What is claimed is:

1. A computer-implemented method comprising:
obtaining, by a computer, call data for an incoming call indicating a source automatic number identification (ANI) and one or more user accounts corresponding to the source ANI in the call data for the incoming call;
extracting during the incoming call, by the computer, one or more features for the incoming call using the call data for the incoming call;
extracting during the incoming call, by the computer, a feature vector for the incoming call based upon the one or more features extracted using the call data for the incoming call; and
generating, by the computer, a risk score for the incoming call by executing a machine learning model on the feature vector generated for the incoming call, the machine learning model trained on the call data of a plurality of past calls, a plurality of source ANIs, and a plurality of user accounts corresponding to the plurality of source ANIs.

2. The method according to claim 1 , wherein obtaining the call data for the incoming call includes:
receiving, by a computer, a plurality of timestamps and corresponding interaction steps with an interactive voice response (IVR) system during the incoming call.

3. The method according to claim 1 , wherein extracting the feature vector includes:
generating, by the computer, one or more velocity features for the source ANI based upon the call data for the incoming call.

4. The method according to claim 3 , wherein extracting a velocity feature includes:
determining, by the computer, a number of accounts associated with the source ANI.

5. The method according to claim 3 , wherein extracting a velocity feature includes:
determining, by the computer, a number of destination ANIs associated with the source ANI.

6. The method according to claim 1 , wherein generating the feature vector includes:
extracting, by the computer, a behavior feature for the incoming call based upon the plurality of timestamps and corresponding interaction steps with an IVR system during the incoming call, wherein the feature vector is generated based upon the behavior feature.

7. The method according to claim 1 , further comprising:
obtaining, by the computer, the call data for a plurality of prior calls, the call data for the plurality of prior calls indicating the source ANI for the prior call and one or more user accounts associated with the source ANI; and
training, by the computer, the machine learning model based upon the call data for the plurality of calls indicating each source ANI and the one or more user accounts associated with the source ANI.

8. The method according to claim 7 , further comprising:
receiving, by the computer, user feedback for the plurality of prior calls, the user feedback including an ANI-label pair for each prior call;
training, by the computer, the machine learning model based upon the call data for the plurality of calls and the ANI-label pairs for the plurality of prior calls.

9. The computer-implemented method of claim 1 , further comprising triggering, by the computer, a computer operation based upon the risk score of the incoming call.

10. The computer-implemented method of claim 9 , wherein the triggered computer operation comprises at least one of displaying the risk score on a computer display of an IVR system and disabling a feature in the IVR system.

11. The method according to claim 3 , wherein, when extracting the feature vector, the processor is further configured to:
determine a number of accounts associated with the source ANI.

12. A system comprising:
one or more network interfaces configured to receive call data for one or more incoming calls; and
a computing device comprising processor configured to:
obtain call data for an incoming call indicating a source automatic number identification (ANI) and one or more user accounts corresponding to the source ANI in the call data for the incoming call;
extract, during the incoming call, one or more features for the incoming call using the call data for the incoming call;
extract, during the incoming call, a feature vector for the incoming call based upon the one or more features extracted using the call data for the incoming call; and
generate a risk score for the incoming call by executing a machine learning model on the feature vector generated for the incoming call, the machine learning model trained on the call data of a plurality of past calls, a plurality of source ANIs, and a plurality of user accounts corresponding to the plurality of source ANIs.

13. The system according to claim 12 , wherein, when obtaining the call data for the incoming call, the processor is further configured to:
receive a plurality of timestamps and corresponding interaction steps with an interactive voice response (IVR) system during the incoming call.

14. The system according to claim 12 , wherein, when extracting the feature vector, the processor is further configured to:
extracting, by the computer, one or more velocity features for the source ANI based upon the call data for the incoming call.

15. The system according to claim 14 , wherein, when extracting the feature vector, the processor is further configured to:
determine a number of destination ANIs associated with the source ANI.

16. The system according to claim 12 , wherein, when generating the feature vector, the processor is further configured to:
extract a behavior feature for the incoming call based upon the plurality of timestamps and corresponding interaction steps with an IVR system during the incoming call, wherein the feature vector is generated based upon the behavior feature.

17. The system according to claim 12 , wherein the processor is further configured to:
obtain the call data for a plurality of prior calls, the call data for the plurality of prior calls indicating the source ANI for the prior call and one or more user accounts associated with the source ANI; and
train the machine learning model based upon the call data for the plurality of calls indicating each source ANI and the one or more user accounts associated with the source ANI.

18. The system according to claim 17 , the processor is further configured to:
receive user feedback for the plurality of prior calls, the user feedback including an ANI-label pair for each prior call;
train the machine learning model based upon the call data for the plurality of calls and the ANI-label pairs for the plurality of prior calls.

19. The system according to claim 12 , wherein the processor is further configured to:
trigger a computer operation based upon the risk score of the incoming call.

20. The system according to claim 19 , wherein the triggered computer operation comprises at least one of displaying the risk score on a computer display of an IVR system and disabling a feature in the IVR system.

Assignees

• Pindrop Security Inc

Inventors

• Strong Scott
• PATIL Kailash
• Dewey David
• BANDYOPADHYAY Raj
• Calhoun Telvis
• Balasubramaniyan Vijay

Classifications

• G06F21/32 Primary

  using biometric data, e.g. fingerprints, iris scans or voiceprints · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• G06N20/00

  Machine learning · CPC title

• H04M3/493

  Interactive information services, e.g. directory enquiries {; Arrangements therefor, e.g. interactive voice response [IVR] systems or voice portals} · CPC title

• H04M3/527

  Centralised call answering arrangements not requiring operator intervention · CPC title