# US 12,192,400 B2 · Relationship graphs for telecommunication network fraud detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,400 B2 - Document ID: US12192400B2 - Status: Granted - Kind: B2 - Application number: 17/566,905 - Filed: 2021-12-31 - Published: 2023-07-06 - Granted: 2025-01-07 - Earliest claimed: 2021-12-31 - Assignees: AT&T Intellectual Property I, L.P. - Applicants: AT&T Intellectual Property I, L.P. - Inventors: Surya Murali; Edmond J. Abrahamian; Ana Armenta; Prince Paulraj; Elijah Hall - Web page: https://patentgrep.com/patent/US12192400B2 ## CPC - H04M 15/47: {Fraud detection or prevention means} - G06N 5/022: Knowledge engineering; Knowledge acquisition - G06N 20/00: Machine learning - H04L 12/14: Charging, metering or billing arrangements specially adapted for data communications, e.g. authentication, authorisation and accounting [AAA] framework - H04M 3/2218: {Call detail recording} - H04M 3/2281: {Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls} - H04M 3/36: Statistical metering, e.g. recording occasions when traffic exceeds capacity of trunks - H04M 15/00: Arrangements for metering, time-control or time indication {; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP} - H04M 15/41: {Billing record details, i.e. parameters, identifiers, structure of call data record [CDR]} - H04M 15/57: {for integrated multimedia messaging subsystem [IMS]} - H04W 4/24: Accounting or billing - H04W 8/26: Network addressing or numbering for mobility support - H04M 2203/6027: Fraud preventions - H04M: TELEPHONIC COMMUNICATION (circuits for controlling other apparatus via a telephone cable and not involving telephone switching apparatus G08) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A processing system may maintain a relationship graph that includes nodes and edges representing phone numbers and device identifiers having associations with the phone numbers. The processing system may obtain an identification of a first phone number or a first device identifier for a fraud evaluation and extract features from the relationship graph associated with at least one of the first phone number or the first device identifier. The plurality of features may include one or more device identifiers associated with the first phone number, or one or more phone numbers associated with the first device identifier. The processing system may then apply the features to a prediction model that is implemented by the processing system and that is configured to output a fraud risk value of the first phone number or the first device identifier and implement at least one remedial action in response to the fraud risk value. ## Claims ### Claim 1 A method comprising: maintaining, by a processing system including at least one processor, a relationship graph that includes nodes and edges, the relationship graph representing a plurality of phone numbers and a plurality of device identifiers having associations with the plurality of phone numbers, wherein at least a first portion of the nodes of the relationship graph represents the plurality of phone numbers and at least a second portion of the nodes of the relationship graph represents the plurality of device identifiers, and wherein at least a first portion of the edges of the relationship graph represents relationships between the plurality of phone numbers and the plurality of device identifiers; obtaining, by the processing system, an identification of a first phone number of the plurality of phone numbers or a first device identifier of the plurality of device identifiers for a fraud evaluation; extracting, by the processing system, a plurality of features from the relationship graph, the plurality of features associated with at least one of: the first phone number or the first device identifier, wherein the plurality of features includes: one or more device identifiers of the plurality of device identifiers associated with the first phone number, or one or more phone numbers of the plurality of phone numbers associated with the first device identifier; applying, by the processing system, the plurality of features to a prediction model that is implemented by the processing system and that is configured to output a fraud risk value of the first phone number or the first device identifier; and implementing, by the processing system, at least one remedial action in response to the fraud risk value. ### Claim 2 (depends on 1) The method of claim 1, wherein the plurality of device identifiers comprises international mobile equipment identity values. ### Claim 3 (depends on 1) The method of claim 1, wherein each of the plurality of phone numbers is identified from an international mobile subscriber identity value. ### Claim 4 (depends on 1) The method of claim 1, wherein at least a portion of the plurality of phone numbers comprises phone numbers of subscribers of a telecommunication network, wherein the relationships between the plurality of phone numbers and the plurality of device identifiers are identified from call detail records of the telecommunication network. ### Claim 5 (depends on 1) The method of claim 1, wherein at least a second portion of the edges represents relationships between the plurality of phone numbers. ### Claim 6 (depends on 5) The method of claim 5, wherein the relationships between the plurality of phone numbers include at least one of: calls between at least a first portion of the plurality of phone numbers; or trusted relationships between at least a second portion of the plurality of phone numbers. ### Claim 7 (depends on 1) The method of claim 1, wherein the plurality of features includes at least one of: a number of device identifiers associated with the first phone number; or a number of phone numbers associated with the first device identifier. ### Claim 8 (depends on 1) The method of claim 1, wherein at least one of the nodes is labeled with an indicator of a known fraud association, wherein the plurality of features includes the known fraud association. ### Claim 9 (depends on 1) The method of claim 1, wherein at least a third portion of the nodes of the relationship graph represents a plurality of billing accounts, and wherein at least a second portion of the edges of the relationship graph represents relationships between at least one of: the plurality of phone numbers and the plurality of billing accounts, or the plurality of device identifiers and the plurality of billing accounts. ### Claim 10 (depends on 9) The method of claim 9, wherein the plurality of features includes a number of device identifiers associated with at least one of the plurality of billing accounts. ### Claim 11 (depends on 1) The method of claim 1, wherein the extracting of the plurality of features from the relationship graph comprises: generating at least one vector via a graph embedding process applied to the relationship graph. ### Claim 12 (depends on 11) The method of claim 11, wherein the applying of the plurality of features to the prediction model comprises applying the at least one vector as at least one input to the prediction model. ### Claim 13 (depends on 11) The method of claim 11, wherein the graph embedding process is trained as part of the prediction model or is trained as a separate process from the prediction model. ### Claim 14 (depends on 11) The method of claim 11, wherein the at least one vector encodes information about at least one of the nodes or at least one of the edges between two of the nodes. ### Claim 15 (depends on 14) The method of claim 14, wherein the at least one vector encodes information from at least two-hops away from a node representing the first phone number or the first device identifier. ### Claim 16 (depends on 1) The method of claim 1, wherein the prediction model comprises a fraud detection model. ### Claim 17 (depends on 1) The method of claim 1, wherein the prediction model comprises a machine learning model. ### Claim 18 A non-transitory computer-readable medium storing instructions which, when executed by a processing system including at least one processor, cause the processing system to perform operations, the operations comprising: maintaining a relationship graph that includes nodes and edges, the relationship graph representing a plurality of phone numbers and a plurality of device identifiers having associations with the plurality of phone numbers, wherein at least a first portion of the nodes of the relationship graph represents the plurality of phone numbers and at least a second portion of the nodes of the relationship graph represents the plurality of device identifiers, and wherein at least a first portion of the edges of the relationship graph represents relationships between the plurality of phone numbers and the plurality of device identifiers; obtaining an identification of a first phone number of the plurality of phone numbers or a first device identifier of the plurality of device identifiers for a fraud evaluation; extracting a plurality of features from the relationship graph, the plurality of features associated with at least one of; the first phone number or the first device identifier, wherein the plurality of features includes: one or more device identifiers of the plurality of device identifiers associated with the first phone number, or one or more phone numbers of the plurality of phone numbers associated with the first device identifier; applying the plurality of features to a prediction model that is implemented by the processing system and that is configured to output a fraud risk value of the first phone number or the first device identifier; and implementing at least one remedial action in response to the fraud risk value. ### Claim 19 An apparatus comprising: a processing system including at least one processor; and a non-transitory computer-readable medium storing instructions which, when executed by the processing system, cause the processing system to perform operations, the operations comprising: maintaining a relationship graph that includes nodes and edges, the relationship graph representing a plurality of phone numbers and a plurality of device identifiers having associations with the plurality of phone numbers, wherein at least a first portion of the nodes of the relationship graph represents the plurality of phone numbers and at least a second portion of the nodes of the relationship graph represents the plurality of device identifiers, and wherein at least a first portion of the edges of the relationship graph represents relationships between the plurality of phone numbers and the plurality of device identifiers; obtaining an identification of a first phone number of the plurality of phone numbers or a first device identifier of the plurality of device identifiers for a fraud evaluation; extracting a plurality of features from the relationship graph, the plurality of features associated with at least one of: the first phone number or the first device identifier, wherein the plurality of features includes: one or more device identifiers of the plurality of device identifiers associated with the first phone number, or one or more phone numbers of the plurality of phone numbers associated with the first device identifier; applying the plurality of features to a prediction model that is implemented by the processing system and that is configured to output a fraud risk value of the first phone number or the first device identifier; and implementing at least one remedial action in response to the fraud risk value. ### Claim 20 (depends on 19) The apparatus of claim 19, wherein the plurality of device identifiers comprises international mobile equipment identity values.