Back to results
US 12,598,201 B2Granted
Multifaceted detection of fraudulent data usage
AssigneeVerizon Patent and Licensing Inc.
InventorsJacob Methner, Khurram Abbas, Kevin Michael Robinson
Life of this patent
Estimating the term…
Abstract
A method, a network device, and a non-transitory computer-readable storage medium are described in relation to a multifaceted detection of fraudulent data usage service. The multifaceted detection of fraudulent data usage service may apply fraudulent detection to multiple facets of network usage including end device identifier analysis, end device registration analysis, traffic analysis, and end device examination analysis. The multifaceted detection of fraudulent data usage service may include weightings and scoring associated with the examinations.
Claims20
A method comprising:
- selecting, by a network device, an end device for examination of fraudulent activity;
- examining, by the network device based on the selecting, an end device identifier of the end device;
- examining, by the network device, registration information of the end device, wherein the registration information includes information indicating whether the end device registers and re-registers with an application layer network according to a prescribed schedule set by the application layer network and multiple registrations and attachments of the end device with a radio access network and a core network;
- examining, by the network device, user traffic of the end device;
- examining, by the network device, operational data of the end device, wherein the operational data includes a network port and associated network port number and usage of the network port and network port number relative to an application service at the end device;
- determining, by the network device based on results of the examinations of the end device identifier, the registration information, the user traffic, and the operational data, whether the end device exhibits the fraudulent activity;
- and
- assigning, by the network device based on determining that the end device exhibits the fraudulent activity, a static network address to the end device.
5 more elements
A network device comprising:
- a processor that is configured to:
- select an end device for examination of fraudulent activity;
- examine, based on the selection, an end device identifier of the end device;
- examine registration information of the end device, wherein the registration information includes information indicating whether the end device registers and re-registers with an application layer network according to a prescribed schedule set by the application layer network and multiple registrations and attachments of the end device with a radio access network and a core network;
- examine user traffic of the end device;
- examine operational data of the end device, wherein the operational data includes a network port and associated network port number and usage of the network port and network port number relative to an application service number and usage at the end device;
- determine based on results of the examinations of the end device identifier, the registration information, the user traffic, and the operational data, whether the end device exhibits the fraudulent activity;
- and
- assign, based on a determination that the end device exhibits the fraudulent activity, a static network address to the end device.
6 more elements
A non-transitory computer-readable storage medium storing instructions executable by a processor of a network device, wherein the instructions are configured to:
- select an end device for examination of fraudulent activity;
- examine, based on the selection, an end device identifier of the end device;
- examine registration information of the end device, wherein the registration information includes information indicating whether the end device registers and re-registers with an application layer network according to a prescribed schedule set by the application layer network and multiple registrations and attachments of the end device with a radio access network and a core network;
- examine user traffic of the end device;
- examine operational data of the end device, wherein the operational data includes a network port and associated network port number and usage of the network port and network port number relative to an application service number and usage at the end device;
- determine based on results of the examinations of the end device identifier, the registration information, the user traffic, and the operational data, whether the end device exhibits the fraudulent activity;
- and
- assign, based on a determination that the end device exhibits the fraudulent activity, a static network address to the end device.
5 more elements
Dependencies are inferred from the claim text.