System and method for detecting and managing fraud

A multi-layer fraud detection system using artificial intelligence for a telecommunications system, the telecommunications system comprising a network layer having at least one telecommunications network, a service control layer for managing the network layer and for generating service records containing data representing instances of telecommunications in the network layer, and a data management layer for receiving the service records from various components and processes of the service control layer and for reducing data by eliminating redundancy and consolidating multiple records into network event records, the multi-layer fraud detection system comprising:

• a detection layer comprising a core infrastructure and a configurable, domain specific implementation to receive network event records from the data management layer, to test the network event records for possible fraud and to generate alarms indicating incidences of suspected fraud;
• an analysis layer to receive alarms generated by the detection layer and to consolidate the alarms into fraud cases;
• and
• an expert system layer comprising a core infrastructure and a configurable, domain specific implementation to receive fraud cases from the analysis layer and to act upon certain of the fraud cases.

A method for detecting fraud and automatically generating alarms based on real-time event data in a telecommunications system by using artificial intelligence, comprising the steps of:

• (1) analyzing a history of network event records to identify normal and fraudulent patterns;
• (2) determining whether a network event record violates a selected threshold rule by comparing said network event record with a selected profile, wherein said threshold rule and said selected profile include a scalable core infrastructure and a user-configurable, domain-specific implementation within a layered logical systems architecture;
• (3) determining whether the network event record deviates from a selected profile;
• (4) generating an alarm when the network event record violates the selected threshold rule;
• and
• (5) generating an alarm when the network event record deviates from the selected profile.

A computer program product comprising a computer readable medium having computer program logic stored therein for enabling a computer system to process network event records to detect fraud and automatically generate alarms in a telecommunications system based on real-time event data and using artificial intelligence in a scalable core infrastructure with user-specific implementation rules, wherein said computer-program logic comprises:

• means for enabling a computer system to test network event records;
• means for enabling said computer system to generate alarms when a network event record pattern deviates from a selected profile;
• means for enabling said computer system to correlate the alarms generated into categories based on known common aspects of said alarms;
• and
• means for enabling said computer system to respond to certain alarms of said categories.

A data processing system comprising:

• normalizing means for accepting data in various formats and converting it into a predetermined formats and filtering it;
• data enhancing means accepting the data in a predetermined format from the normalizing means and based upon information included in the data or extended data, deriving additional attributes to create enhanced data;
• means, accepting the enhanced data from the data enhancing means, for identifying particular patterns in the enhanced data;
• correlation means, accepting the filtered enhanced data from the filtering means, for correlating and consolidating the filtered enhanced data based upon predetermined criteria and obtaining additional information from external sources to generate aggregated structures;
• and
• prioritizing means, accepting the aggregated structures from the correlation means, for ordering the aggregated structures for subsequent processing.

A data processing method comprising:

• converting data in various formats into predetermined formats and filtering it;
• creating enhanced data by deriving additional attributes from the data in a predetermined format;
• filtering the enhanced data to identify particular patterns in the enhanced data;
• correlating and consolidating the filtered enhanced data based upon predetermined criteria and obtaining additional information from external sources to generate aggregated structures;
• and
• prioritizing the aggregated structures for subsequent processing.