# US 2023/0409606 A1 · Method and apparatus for detecting anomolies in communication data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2023/0409606 A1 - Document ID: US20230409606A1 - Status: Published application - Kind: A1 - Application number: 17/843,111 - Filed: 2022-06-17 - Published: 2023-12-21 - Earliest claimed: 2022-06-17 - Assignees: Talkdesk, Inc. - Applicants: Talkdesk, Inc. - Inventors: Pedro Filipe Caldeira Neves; Nuno André de Matos Lopes Cardoso - Web page: https://patentgrep.com/patent/US20230409606A1 ## CPC - G06F 16/285: {Clustering or classification} - G06F 16/906: Clustering; Classification - G06F 16/2282: {Tablespace storage structures; Management thereof} - G06Q 10/063114: {Status monitoring or status determination for a person or group} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract A method and system for determining anomalies in call center communications. Data relating to communications is streamed and processed to obtain baseline probability distributions over various domains of communications. Streams related to subsequent calls are compared to the baselines to determine anomalies. ## Claims ### Claim 1 A method for creating a baseline database to be used to increase security in a call center implemented over a computing network by detecting anomalies in communication activities between call center agents and call center users, the method comprising: monitoring at least one stream of communication activity data indicating parameters of communication activities between call center agents and call center users; storing the communication activity data in a collected data database; aggregating the communication activity data into aggregated data; and creating, based on the aggregated data, at least one distribution of communication metrics over a period of time. ### Claim 2 (depends on 1) The method of claim 1, wherein at least one stream of communication activity data includes at least one of event audit logs, communication events, account information, and agent status data. ### Claim 3 (depends on 2) The method of claim 2, further comprising creating use case specific tables and analytics based on the communication activity data. ### Claim 4 (depends on 1) The method of claim 1, wherein the at least one distribution includes an agent baseline distribution of communication metrics for each of the agents per day and a peer baseline distribution of communication metrics for at least one group of the agents per day. ### Claim 5 (depends on 1) The method of claim 1, wherein the agent baseline distribution and the peer baseline distribution each include metrics of communications by relevant agents. ### Claim 6 (depends on 1) The method of claim 1, wherein the at least one stream of communication data includes direct data about communications and derived data about communications. ### Claim 7 A method for increasing security in a call center implemented over a computing network by detecting anomalies in communication activities between call center agents and call center users, the method comprising: monitoring event parameters of communication activities between call center agents and user; querying a baseline distribution database to determine that an event parameter represents a communication anomaly when the event parameter indicates an event that corresponds to a probability that is lower than a predetermined threshold probability and a calculated confidence of the event is higher than a predetermined confidence threshold, wherein the baseline distribution database is created by monitoring at least one stream of communication activity data indicating parameters of communication activities between call center agents and call center users, storing the communication activity data in a collected data database and aggregating the communication activity data to create at least one distribution of communication metrics over a period of time; and storing a record of the communication anomaly in and anomaly database. ### Claim 8 (depends on 7) The method of claim 7, wherein at least one stream of communication activity data includes at least one of event audit logs, communication events, account information, and agent status data. ### Claim 9 (depends on 8) The method of claim 8, further comprising creating use case specific tables and analytics based on the communication activity data. ### Claim 10 (depends on 7) The method of claim 7, wherein the at least one distribution includes an agent baseline distribution of communication metrics for each of the agents per day and a peer baseline distribution of communication metrics for at least one group of the agents per day. ### Claim 11 (depends on 7) The method of claim 7, wherein the at least one distribution includes an agent baseline distribution of communication metrics for each of the agents per day and a peer baseline distribution of communication metrics for at least one group of the agents per day. ### Claim 12 (depends on 7) The method of claim 7, wherein the at least one stream of communication data includes direct data about communications and derived data about communications. ### Claim 13 A system for creating a baseline database to be used to increase security in a call center implemented over a computing network by detecting anomalies in communication activities between call center agents and call center users, the system comprising: at least one memory storing computer executable instructions; and at least one processor which, when executing the instructions accomplishes the method of: monitoring at least one stream of communication activity data indicating parameters of communication activities between call center agents and call center users; storing the communication activity data in a collected data database; aggregating the communication activity data into aggregated data; and creating based on the aggregated data, at least one distribution of communication metrics over a period of time. ### Claim 14 (depends on 13) The system of claim 13, wherein at least one stream of communication activity data includes at least one of event audit logs, communication events, account information, and agent status data. ### Claim 15 (depends on 14) The system of claim 14, wherein the method further comprises creating use case specific tables and analytics based on the communication activity data. ### Claim 16 (depends on 13) The system of claim 13 wherein the at least one distribution includes an agent baseline distribution of communication metrics for each of the agents per day and a peer baseline distribution of communication metrics for at least one group of the agents per day. ### Claim 17 (depends on 13) The system of claim 13 wherein the agent baseline distribution and the peer baseline distribution each include metrics of communications by relevant agents. ### Claim 18 (depends on 13) The system of claim 13 wherein the at least one stream of communication data includes direct data about communications and derived data about communications. ### Claim 19 A system for increasing security in a call center implemented over a computing network by detecting anomalies in communication activities between call center agents and call center users, the system comprising: at least one memory storing computer executable instructions; and at least one processor which, when executing the instructions accomplishes the method of: monitoring event parameters of communication activities between call center agents and user; querying a baseline distribution database to determine that an event parameter represents a communication anomaly when the event parameter indicates an event that corresponds to a probability that is lower than a predetermined threshold probability and a calculated confidence of the event is higher than a predetermined confidence threshold, wherein the baseline distribution database is created by monitoring at least one stream of communication activity data indicating parameters of communication activities between call center agents and call center users, storing the communication activity data in a collected data database and aggregating the communication activity data to create at least one distribution of communication metrics over a period of time; and storing a record of the communication anomaly in and anomaly database. ### Claim 20 (depends on 19) The system of claim 19, wherein at least one stream of communication activity data includes at least one of event audit logs, communication events, account information, and agent status data. ### Claim 21 (depends on 20) The system of claim 20, wherein the method further comprises creating use case specific tables and analytics based on the communication activity data. ### Claim 22 (depends on 19) The system of claim 19, wherein the at least one distribution includes an agent baseline distribution of communication metrics for each of the agents per day and a peer baseline distribution of communication metrics for at least one group of the agents per day. ### Claim 23 (depends on 19) The system of claim 19, wherein the at least one distribution includes an agent baseline distribution of communication metrics for each of the agents per day and a peer baseline distribution of communication metrics for at least one group of the agents per day. ### Claim 24 (depends on 19) The system of claim 19, wherein the at least one stream of communication data includes direct data about communications and derived data about communications.