# US 10,873,860 B2 · System and method for real time fraud analysis of communications data

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,873,860 B2
- Document ID: US10873860B2
- Status: Granted
- Kind: B2
- Application number: 16/677,447
- Filed: 2019-11-07
- Published: 2020-03-05
- Granted: 2020-12-22
- Earliest claimed: 2016-04-11
- Assignees: Tata Communications (America) Inc.
- Applicants: Tata Communications (America) Inc.
- Inventors: Carlos Miranda; Manish Arora; Kumar Thirumalaiappan; Brian Dowd
- Web page: https://patentgrep.com/patent/US10873860B2

## CPC

- H04W 12/12: Detection or prevention of fraud
- G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- H04L 63/101: {Access control lists [ACL]}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04M 1/663: Preventing unauthorised calls to a telephone set
- H04M 3/42059: {Making use of the calling party identifier}
- H04M 3/42102: {Making use of the called party identifier}
- H04M 3/436: Arrangements for screening incoming calls {, i.e. evaluating the characteristics of a call before deciding whether to answer it (based on the calling party profile H04M3/42059; based on location H04M3/42348; based on presence H04M3/42365; diversion H04M3/54)}
- H04M 7/0078: {Security; Fraud detection; Fraud prevention}
- H04M 15/47: {Fraud detection or prevention means}
- H04M 15/56: {for VoIP communications}
- H04M 15/59: {based on real time}
- H04M 15/8044: {Least cost routing}
- H04W 4/14: Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]
- H04W 4/24: Accounting or billing
- H04M 2203/6027: Fraud preventions
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04M: TELEPHONIC COMMUNICATION (circuits for controlling other apparatus via a telephone cable and not involving telephone switching apparatus G08)

## Abstract

A telecommunications service provider's real time analysis system analyzes communications data to detect potentially fraudulent communications data, where the analysis is performed in real time in the routing path of the communications data. The communications data may include calls (e.g., SS7, VoIP, etc. based calls) and messages (e.g., SMS, MMS, etc.). The real time analysis system rejects potentially fraudulent communications data and non-fraudulent communications data in order to be used in real time in the routing path of the communications data. A rejection by the real time analysis system may cause non-fraudulent communications data to still be sent to the intended destination of the communications data. The real time analysis system can be in the routing path of the communications data without further routing non-fraudulent communications data traffic to the next appropriate hop in the routing path.

## Claims

### Claim 1

A telecommunications system comprising:
a processor; and
a memory device that stores a plurality of instructions, which when executed by the processor, causes the processor to:
receive a request from a server to route communications data, the communications data including a plurality of communications attributes;
analyze the communications data to determine if at least one of the plurality of communications attributes associated with the communications data is on a blacklist;
if at least one of the plurality of communications attributes associated with the communications data is on the blacklist, generate a first rejection message, where the first rejection message would cause the communications data to be blocked from further routing;
if none of the plurality of communications attributes associated with the communications data are on the blacklist, generate a second rejection message, where the second rejection message would cause the communications data to be blocked from further routing; and
transmit the first rejection message or the second rejection message to the server;
wherein if the second rejection message is sent, then the second rejection message causes the server to route the communications data to another server to deliver the communications data, and
wherein the communications data is call signaling associated with a voice call and the at least one of the plurality of communications attributes is a country code.

### Claim 2 (depends on 1)

The telecommunications system of claim 1, wherein if at least one of the plurality of communications attributes associated with the communications data is on the blacklist, flag the communications data as fraudulent.

### Claim 3 (depends on 2)

The telecommunications system of claim 2, wherein the processor further analyzes the flagged communications data to determine if the at least one of the plurality of communications attributes associated with the communications data is on a whitelist.

### Claim 4 (depends on 3)

The telecommunications system of claim 3, wherein if the at least one of the plurality of communications attributes associated with the communications data is on the whitelist, generate the second rejection message.

### Claim 5 (depends on 1)

The telecommunications system of claim 1, wherein the second rejection message is a session initiation protocol 503 service unavailable message.

### Claim 6 (depends on 1)

The telecommunications system of claim 1, wherein the second rejection message is an SS7 release 34 message.

### Claim 7 (depends on 1)

The telecommunications system of claim 1, wherein the first rejection message is a session initiation protocol 403 forbidden message SS7 release 34 message.

### Claim 8 (depends on 1)

The telecommunications system of claim 1, wherein the first rejection message is an SS7 release 21 message.

### Claim 9

A method of operating a telecommunications system comprising:
receiving, with a processor, a request from a server to route communications data, the communications data including a plurality of communications attributes;
analyzing, with the processor, the communications data to determine if at least one of the plurality of communications attributes associated with the communications data is on a blacklist;
if at least one of the plurality of communications attributes associated with the communications data is on the blacklist, generating with the processor, a first rejection message, where the first rejection message would cause the communications data to be blocked from further routing;
if none of the plurality of communications attributes associated with the communications data are on the blacklist, generating with the processor, a second rejection message, where the second rejection message would cause the communications data to be blocked from further routing; and
transmitting, with the processor, the first rejection message or the second rejection message to the server;
wherein if the second rejection message is sent, then the second rejection message causes the server to route the communications data to another server to deliver the communications data, and
wherein the communications data is call signaling associated with a voice call and the at least one of the plurality of communications attributes is a country code.

### Claim 10 (depends on 9)

The method of claim 9, wherein if at least one of the plurality of communications attributes associated with the communications data is on the blacklist, further comprising flagging the communications data as fraudulent.

### Claim 11 (depends on 10)

The method of claim 10, further comprising analyzing the flagged communications data to determine if the at least one of the plurality of communications attributes associated with the communications data is on a whitelist.

### Claim 12 (depends on 11)

The method of claim 11, wherein if the at least one of the plurality of communications attributes associated with the communications data is on the whitelist, further comprising generating the second rejection message.