Systems and methods for detecting call provenance from call audio

Patent metadata

Field	Value
Publication number	US-9516497-B2
Application number	US-201514715549-A
Country	US
Kind code	B2
Filing date	May 18, 2015
Priority date	Jun 29, 2010
Publication date	Dec 6, 2016
Grant date	Dec 6, 2016

Abstract

Various embodiments of the invention are detection systems and methods for detecting call provenance based on call audio. An exemplary embodiment of the detection system can comprise a characterization unit, a labeling unit, and an identification unit. The characterization unit can extract various characteristics of networks through which a call traversed, based on call audio. The labeling unit can be trained on prior call data and can identify one or more codecs used to encode the call, based on the call audio. The identification unit can utilize the characteristics of traversed networks and the identified codecs, and based on this information, the identification unit can provide a provenance fingerprint for the call. Based on the call provenance fingerprint, the detection system can identify, verify, or provide forensic information about a call audio source.

First claim

What is claimed is:

1. A method comprising:
receiving, at a computing device, for a first call, placed from a first party at a first communications device, to an intended second party at an address associated with a second communications device, data representing call audio received at the first communications device during the first call;
determining, by the computing device, based on the data representing the call audio received at the first communications device, a first provenance fingerprint indicative of one or more communications devices participating in the first call with the first communications device;
determining, by the computing device, based on the first provenance fingerprint, that a third communications device is likely participating in the first call from the first party at the first communications device, the third communications device being a different communications device from the first and second communication devices; and
responsive to the determining that the third communications device is likely participating in the first call, outputting an indication that a different communications device from the first and second communications devices is likely participating in the first call.

2. The method of claim 1 , wherein the determining that the third communications device is likely participating in the first call comprises determining that the first provenance fingerprint does not match a previous provenance fingerprint associated with the second communications device.

3. The method of claim 2 , wherein the previous provenance fingerprint is determined based on call audio from a previous call to the address associated with the second communications device.

4. The method of claim 1 , further comprising determining, by the computing device, based on the first provenance fingerprint, that the second communications device is likely not participating in the first call.

5. The method of claim 1 , wherein the indication that a different communications device from the first and second communications devices is likely participating in the first call is output for presentation to the first party.

6. The method of claim 1 , wherein the indication that a different communications device from the first and second communications devices is likely participating in the first call is output for presentation to the second party.

7. The method of claim 1 , wherein the indication that a different communications device from the first and second communications devices is likely participating in the first call is output during the first call.

8. The method of claim 1 , wherein the indication that a different communications device from the first and second communications devices is likely participating in the first call comprises a risk score associated with the first call.

9. The method of claim 1 , wherein the first party and second party are a financial institution and a client of the financial institution.

10. The method of claim 1 , wherein the first call is conducted as part of an authentication scheme.

11. The method of claim 1 , wherein the first call is conducted to gain authorization for a financial transaction.

12. The method of claim 1 , wherein the determining of the first provenance fingerprint is based on analyzing one or more of a noise profile, packet loss characteristics, and speaker-independent artifacts associated with the call audio received at the first communications device during the first call.

13. The method of claim 1 , wherein the determining that the third communications device is likely participating in the first call is absent consideration of call metadata received at the first communications device with the first call.

14. A method comprising:
receiving, at a computing device, for a first call, placed from a first party at a first communications device, to an intended second party at an address associated with a second communications device, data representing call audio received at the first communications device during the first call;
determining, by the computing device, based on the data representing the call audio received at the first communications device, a first provenance fingerprint indicative of one or more communications devices participating in the first call with the first communications device;
determining, by the computing device, based on the first provenance fingerprint, that a third communications device is unlikely to be participating in the first call from the first party at the first communications device, the third communications device being a different communications device from the first and second communication devices; and
responsive to the determining that the third communications device is unlikely to be participating in the first call, outputting an indication that a different communications device from the first and second communications devices is unlikely to be participating in the first call.

15. A method comprising:
receiving, at a computing device, for a first call, between a first communications device and a second communications device, data representing call audio received at the first communications device during the first call, wherein the first call is associated with an expected network path between the first and second communication devices;
determining, by the computing device, based on the data representing the call audio received at the first communications device, a first provenance fingerprint indicative of one or more networks traversed by the first call;
determining, by the computing device, based on the first provenance fingerprint, that an unexpected network path is likely being traversed by the first call, the unexpected network path comprising a different sequence of networks from the expected network path; and
responsive to the determining that the unexpected communications network path is likely being traversed by the first call, outputting an indication that a different network path from the expected network path is likely being traversed by the first call.

16. The method of claim 15 , wherein the determining that the unexpected network path is likely being traversed by the first call comprises determining that the first provenance fingerprint does not match a previous provenance fingerprint associated with the expected network path.

17. The method of claim 16 , wherein the previous provenance fingerprint is determined based on call audio from a previous call between the first communications device and the second communications device over the expected network path.

18. The method of claim 15 , wherein the determining that the unexpected network path is likely being traversed by the first call comprises determining that a type of network not in the expected network path is being traversed by the first call.

19. The method of claim 18 , wherein the type of network not in the expected network path is a voice-over-IP network.

20. The method of claim 18 , wherein the type of network not in the expected network path is a cellular network.

21. The method of claim 18 , wherein the type of network not in the expected network path is a PSTN network.

22. The method of claim 15 , wherein the expected network path is associated with a communications provider, and wherein the indication that a different network path is likely being traversed by the first call is output for presentation to the communications provider.

23. The method of claim 15 , wherein the indication that a differe

Assignees

• Georgia Tech Res Inst

Inventors

• Balasubramaniyan Vijay
• Ahamad Mustaque
• Traynor Patrick Gerard
• Hunter Michael Thomas
• Poonawalla Aamir

Classifications

• H04L65/1076 Primary

  Screening of IP real time communications, e.g. spam over Internet telephony [SPIT] · CPC title

• H04M2203/558

  Databases · CPC title

• H04W12/12

  Detection or prevention of fraud · CPC title

• H04L43/0829

  Packet loss · CPC title

• H04W24/08

  Testing, {supervising or monitoring} using real traffic · CPC title