# US 7,609,818 B2 · Methods and apparatus for reducing data capture and storage requirements for call and transaction related message monitoring and fraud detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 7,609,818 B2 - Document ID: US7609818B2 - Status: Granted - Kind: B2 - Application number: 11/338,846 - Filed: 2006-01-25 - Published: 2006-10-19 - Granted: 2009-10-27 - Earliest claimed: 2004-09-23 - Assignees: Verizon Services Corp. - Inventors: Arthur Doskow; Harry A. Hetz; George Robert Hasenauer; Erik George Gebhardt; Joseph Vecchioli - Web page: https://patentgrep.com/patent/US7609818B2 ## CPC - H04M 3/2281: {Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls} - H04L 63/14: {for detecting or protecting against malicious traffic} - H04M 15/41: {Billing record details, i.e. parameters, identifiers, structure of call data record [CDR]} - H04M 15/58: {based on statistics of usage or network monitoring} - H04M 15/70: {Administration or customization aspects; Counter-checking correct charges} - H04M 15/73: {Validating charges} - H04M 7/06: using auxiliary connections for control or supervision {, e.g. where the auxiliary connection is a signalling system number 7 link} - H04M 7/12: for working between exchanges having different types of switching equipment, e.g. power-driven and step by step or decimal and non-decimal - H04M 2203/6027: Fraud preventions - H04M 2215/0164: Billing record, e.g. Call Data Record [CDR], Toll Ticket[TT], Automatic Message Accounting [AMA], Call Line Identifier [CLI], details, i.e. parameters, identifiers, structure - H04M 2215/0188: Network monitoring; statistics on usage on called/calling number - H04M 2215/70: Administration aspects, modify settings or limits or counter-check correct charges - H04M 2215/7072: Validate charges - H04Q 2213/1307: Call setup - H04Q 2213/13091: CLI, identification of calling line - H04Q 2213/13103: Memory - H04Q 2213/1313: Metering, billing - H04Q 2213/13176: Common channel signaling, CCS7 - H04Q 2213/13213: Counting, timing circuits - H04Q 2213/13216: Code signals, frame structure - H04Q 2213/13339: Ciphering, encryption, security - H04Q 2213/13352: Self-routing networks, real-time routing - H04Q 2213/13383: Hierarchy of switches, main and subexchange, e.g. satellite exchange - H04M: TELEPHONIC COMMUNICATION (circuits for controlling other apparatus via a telephone cable and not involving telephone switching apparatus G08) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04Q: SELECTING (switches, relays, selectors H01H; wireless communication networks H04W) ## Abstract Systems for monitoring, storage, and analysis of information in signaling messages, communicated from originating networks to a destination network through one or more intermediate networks are described. Correlation and comparison between signaling messages of interest sent from an origination network to signaling messages received by the destination network allows for the detection of inconsistent information, e.g., information fields in a communicated message that have been altered, either intentionally or unintentionally, by an intermediate carrier. The introduction of an additional communications path over which notification messages are forwarded from signaling monitoring equipment in the origination network to signaling monitoring equipment in the destination network allows for a significant reduction in the memory storage requirements at the destination network and in the amount of processing required to match, compare, and evaluate signaling messages. In addition, the reduction in stored messages and processing time allows the monitoring system to operate in near-real time allowing for fraud detection while a call is still in progress. ## Claims ### Claim 1 A method comprising: detecting, at a first monitoring system in a first network portion, that a first telephone call-related signaling message originating from the first network portion is directed to a second network portion via an intermediate network, the first telephone call-related signaling message containing first telephone call-related signaling information; storing at least a portion of said first telephone call-related signaling information in a data store associated with the first monitoring system; sending a notification message from the first monitoring system to a second monitoring system in said second network portion using said intermediate network, said notification message indicating that the first telephone call-related signaling message is being communicated to said second network portion; sending said first telephone call-related signaling message to said second network portion through said intermediate network; receiving said notification message at said second monitoring system; receiving at said second network portion from said intermediate network a second telephone call-related signaling message corresponding to the first telephone call-related signaling message, the second telephone call-related signaling message containing second telephone call-related signaling information; and in response to said received notification message, storing at least a portion of said second telephone call-related signaling information in a data store associated with the second monitoring system. ### Claim 2 (depends on 1) The method of claim 1, further comprising: sending the stored portion of the first telephone call-related signaling information to a processing device; sending the stored portion of the second telephone call-related signaling information to the processing device; and comparing at least a portion of said stored portion of said first telephone call-related signaling information to a corresponding portion of said stored portion of the second telephone call-related signaling information to determine if the compared portions are inconsistent. ### Claim 3 (depends on 2) The method of claim 2, wherein said processing device determines if the compared portions are inconsistent while a telephone call to which the portions relate is ongoing. ### Claim 4 (depends on 2) The method of claim 2, wherein said processing device generates a fraud warning when it is determined that the compared portions are inconsistent. ### Claim 5 (depends on 2) The method of claim 2, wherein said first telephone call-related signaling message is an SS7 message related to a telephone call that originates from said first network portion and terminates in said second network portion. ### Claim 6 (depends on 2) The method of claim 2, wherein said processing device is located in said second network portion. ### Claim 7 (depends on 1) The method of claim 1, wherein the first telephone call-related signaling message is transmitted using a first communications path through the intermediate network, and the notification message is communicated using a second communications path through the intermediate network. ### Claim 8 (depends on 1) The method of claim 1, wherein said intermediate network is an Internet Protocol (IP) network. ### Claim 9 (depends on 1) The method of claim 1, wherein the first network portion and second network portion are operated by the same telephone service provider. ### Claim 10 (depends on 1) The method of claim 1, further comprising: temporarily storing a plurality of telephone call-related signaling messages received at the second network portion in a buffer associated with said second monitoring system; wherein storing at least a portion of said second telephone call-related signaling information includes processing the contents of the buffer in response to said notification message. ### Claim 11 (depends on 10) The method of claim 10, wherein processing the contents of the buffer include: transferring the contents of at least a portion of said buffer to said data store associated with the second monitoring system. ### Claim 12 (depends on 11) The method of claim 11, wherein said notification message includes message identification information which can be used to identify the second telephone call-related signaling information; and wherein transferring the contents of at least a portion of said buffer includes: identifying said second telephone call-related signaling information in said buffer contents using said message identification information; and transferring a portion of said buffer that contains said identified second telephone call-related signaling information to the data store associated with the second monitoring system. ### Claim 13 (depends on 1) The method of claim 1, wherein the data store associated with the first monitoring system and the data store associated with the second monitoring system are long-term storage devices. ### Claim 14 (depends on 1) The method of claim 1, wherein the notification message includes message identification information which can be used to identify the second telephone call-related signaling information. ### Claim 15 (depends on 14) The method of claim 14, wherein the message identification information includes at least one of a called party number and a transaction ID. ### Claim 16 (depends on 1) The method of claim 1, wherein detecting that the first telephone call-related signaling message is directed to the second network portion includes determining a called party number of the first telephone call-related signaling message and determining that the called party number is associated with the second network portion. ### Claim 17 (depends on 1) The method of claim 1, wherein the notification message includes the stored portion of the first telephone call-related signaling information. ### Claim 18 (depends on 17) The method of claim 17, further comprising: at the second monitoring system, comparing the stored portion of said first telephone call-related signaling information to a corresponding portion of said stored portion of the second telephone call-related signaling information to determine if the compared portions are inconsistent. ### Claim 19 A method comprising: detecting, at a first monitoring system in a first network portion, that a first signaling message originating from the first network portion is directed to a second network portion via an intermediate network, the first signaling message containing first signaling information; storing at least a portion of said first signaling information in a data store associated with the first monitoring system; sending a notification message from the first monitoring system to a second monitoring system in said second network portion using said intermediate network, said notification message indicating that the first signaling message is being communicated to said second network portion; sending said first signaling message to said second network portion through said intermediate network; receiving said notification message at said second monitoring system; receiving at said second network portion from said intermediate network a second signaling message corresponding to the first signaling message, the second signaling message containing second signaling information; and in response to said received notification message, storing at least a portion of said second signaling information in a data store associated with the second monitoring system. ### Claim 20 A method, comprising: receiving, at a first monitoring system in a first network portion, an indication of a specific group of telephone calls for which monitoring is requested; detecting that a first telephone call-related signaling message originating from the first network portion is associated with the selected group of telephone calls and directed to a second network portion, the first telephone call-related signaling message containing first telephone call-related signaling information; storing at least a portion of said first telephone call-related signaling information in a data store associated with the first monitoring system; sending a notification message from the first monitoring system to a second monitoring system in said second network portion using an intermediate network, said notification message indicating that the first telephone call-related signaling message is being communicated to said second network portion; sending said first telephone call-related signaling message to said second network portion through said intermediate network; receiving said notification message at said second monitoring system; receiving at said second network portion from said intermediate network a second telephone call-related signaling message corresponding to the first telephone call-related signaling message, the second telephone call-related signaling message containing second telephone call-related signaling information; and in response to said received notification message, storing at least a portion of said second telephone call-related signaling information in a data store associated with the second monitoring system; wherein the selected group of telephone calls includes telephone calls directed to at least one telephone number associated with the second network portion.