Fraud Prevention Apparatus and Method for Performing Policing Functions for Telephone Services

This invention is intended for use in traditional telephone networks that carry voice, facsimile or voice-band-data (VBD) traffic. The term "facsimile" represents Group 3 facsimile, which is a ubiquitous international standard for communicating facsimiles of documents over telephone networks. The term "voice-band-data" represents machine-generated information transported over a standard telecommunications voice channel. While facsimile is a form of voice-band-data, it is mentioned separately in this document to highlight the fact that it may be separately classified in the invention.

There is a need for telecommunications service providers to perform policing functions for prevention of fraudulent use of telephone services. As noted by Else and Frantzen in U.S. Pat. No. 4,811,378, fraud prevention is an ongoing challenge for telecommunications service providers: an industry has flourished to develop methods and devices for evasion of billing. Many such devices rely on the fact that most of today's telecommunications switches open a communications channel as soon as a call is placed, even though billing does not start until the network establishes that the call has been answered. As a consequence, the answering party can evade billing by using a device that withholds the answer supervision response, which is the signal that indicates that the call has been answered.

Customers with 1-800 numbers have a strong motivation to evade billing through suppression of the answer supervision response because they both answer the call and receive the bill. Such customers usually have the means to evade billing as well, as they generally operate telephone switching equipment called private-branch exchanges (PBXs) which can be configured to suppress the answer supervision response.

Suitable approaches for control of answer supervision fraud are as follows:

1. Switches in the telephone network could be upgraded in accordance with U.S. Pat. No. 4,811,378 such that an open talk channel is only provided after the answer supervision response is observed. Such an upgrade is extremely expensive and time-consuming. Furthermore, one has the technical challenge of ensuring that customers hear each other soon as the call is answered, which is the reason that most switches were designed to provide an open talk channel during call setup.

2. A device such as is described in U.S. Pat. No. 4,811,378 could be inserted into the network so as to block one side of the communications channel until the answer supervision response is observed. Such a device interferes in the normal functioning of the network for all calls, only a small minority of which are fraudulent. Means must be incorporated into the network to promptly disable the device when the call is answered, and to override the device when required for network maintenance and administration. Furthermore, such a device will block service usage by honest customers when the answer supervision response is missed because of equipment failure within the network.

3. Intervention could be imposed when a call remains unanswered for an inordinate period of time. The intervention may be to terminate the call or to insert the missing answer supervision response. Unfortunately, the time-out period for this approach needs to be quite long because honest customers may wait a significant period of time for a call to be answered. Also, failure to produce an answer supervision response can be due to faults in the network equipment, and it is not desirable to disturb honest customers when such is the case.

There is a need for telecommunications service providers to regulate access to specialized telephone services which depend on the manner of customers' use. Such a function is performed by a predecessor to the present invention, herein called the FaxCom device.sup.1. The FaxCom device was deployed across Canada in 1990 to support a reduced-rate facsimile-and-data-only service called FaxCom. It has also been demonstrated and sold to various international clients since 1990, and it has been offered as a vehicle for implementing class-based billing, where customers are billed differently based on whether their calls are voice, facsimile or voice-band-data. A general description of the FaxCom device was published in an article by Randall A. Law, Terrence W. Holm and Neil B. Cox entitled "Real-Time Multi-Channel Monitoring of Communications on a T1 Span", published in the Proceedings of the 1991 IEEE Pacific Rim Conference on Communications, Computers and Signal Processing at pages 306 to 309.

The FaxCom device determines whether Voice, Facsimile or VBD are present on designated telephone calls, and imposes a voice message and terminates the call when voice is observed. The FaxCom device only applies policing when both sides of the channel are off-hook, which precludes its use in policing of call setup processes for control of answer supervision fraud. The FaxCom device does not separately classify handshaking signals or audible network signaling, and as a consequence it is unnecessarily slow in detecting Facsimile and VBD. Finally, the FaxCom device is not suitable when the direction of traffic flow is important, as it is not able determine which end of the communications channel is generating traffic.

Other patents include components for classifying telephone signals, such as U.S. Pat. No. 5,539,804, U.S. Pat. No. 4,809,272, U.S. Pat. No. 4,815,137, U.S. Pat. No. 4,815,136 and U.S. Pat. No. 4,720,862. However, none of these other inventions is comprised of a comparable combination of signal classification and source classification for policing of specialized telephone services.

Therefore, there is a need for a system and method to actively determine the properties of customer usage of telephone services, and to promptly implement prescribed actions based on the observed properties. This enables telecommunications service providers to perform policing functions for prevention of fraudulent use of telephone services. This also provides a means for regulating access to specialized telephone services which depend on the manner of customers' use.

An object of the present invention is to allow telecommunications service providers to apply policing functions for telephone services on ubiquitous telephone networks that carry voice, facsimile and data traffic. According to the invention there is a channel state detector, a traffic classifier, a source classifier and a regulator device which combine to conditionally impose prescribed actions based on the observed properties of traffic on a communications channel

There is provided a No-Answer-Supervision Control Platform (NASCP) which prevents unscrupulous users of telephone services from avoiding billing through suppression of the answer supervision response. The NASCP actively detects when voice, facsimile or voice-band-data is seen to emerge from a side of a communications channel that is apparently on-hook based on the network signaling. Prescribed actions are promptly applied when such illegal activity is detected. The prescribed actions may include imposition of a recorded voice message, forced call termination, forced network signaling or other actions. The NASCP is preferred over alternative solutions because it is rapid in detection of illegal activity, it avoids the time and expense of upgrading switches in the network, and it only alters the normal functioning of the network when illegal usage is detected.

There is also provided a device to enable the offering of specialized telephone services which depend on the manner of customers' use. The apparatus actively determines whether the traffic on each side of a communications channel is voice, facsimile or voice-band-data, it determines which end the communications channel is generating the traffic, and it conditionally performs prescribed actions based on predefined rules on allowable traffic properties. The prescribed actions may include imposition of a recorded voice message, forced call termination, forced network signaling, application of specialized billing functions or other actions. The invention is preferred over alternative devices because it allows class-dependent actions to be imposed sooner in a call than was previously possible, it opens up new policing applications where the policing functions depend on which end of the call is generating the traffic, and it can be applied when only one side of the channel is off-hook.

The novel features believed characteristic of the invention are set forth in the appended claims. The invention itself, however, as well as other features and advantages thereof, will be best understood by reference to the description which follows, read in conjunction with the accompanying drawings wherein:

FIG. 1 is a general illustration of a representative embodiment of the invention.

FIG. 2 illustrates an embodiment of the first stage in the Traffic Classifier of FIG. 1.

FIG. 3 illustrates an embodiment of the second stage in the Traffic Classifier of FIG. 1.

FIG. 4 illustrates an embodiment of the first stage in the Source Classifier of FIG. 1.

FIG. 5 illustrates an embodiment of the second stage in the Source Classifier of FIG. 1.

FIG. 6 summarizes network-generated signals that may occur when only one side of a channel is off-hook.

Referring to FIG. 1 there is shown a block diagram of a representative embodiment of the invention. Briefly, the Channel State Detector 10 determines when to activate policing functions; the Traffic Classifier 20 determines an overall classification of the traffic, taking into account signal classifications derived from both sides of the Communications Channel 4; the Source Classifier 40 determines which side of the channel is generating the traffic; and the Regulator 60 implements prescribed actions based on information from the Traffic Classifier 20 and the Source Classifier 40. A Network Controller 80 is included to represent the interface with network control entities to provide a platform for general control, management and data collection functions. The Network Controller 80 may be omitted in some embodiments.

Channel State Detector 10

The Channel State Detector 10 detects when the Communications Channel 4 is in a state that warrants activation of policing functions. This usually amounts to enabling or disabling of policing functions depending on the hook-state of the channel. For example, policing functions for the NASCP are activated when only one side of the channel is off-hook, and policing functions for a facsimile-and-data-only service such as FaxCom are activated when both sides of the channel are off-hook. The hook-state of the channel may be determined from signaling information within the Communications Channel 4 (dashed lines 7), or from a separate signaling source (dotted line 9), depending on the signaling conventions used in the telephone network. In particular, dashed lines 7 are used for networks operated in accordance with what is commonly called Channel Associated Signaling (CAS) protocols, and dotted line 9 is used for networks operating in accordance with what is commonly called Common Channel Signaling (CCS) protocols. The output 19 of the Channel State Detector 10 is an enable/disable signal used for activating or deactivating policing functions in other parts of the invention.

Traffic Classifier 20

The Traffic Classifier 20 produces an output Traffic Class 39 which characterizes the traffic on the Communications Channel 4 at any given point in time. This is typically a two-stage process, where the first stage involves derivation of two signal classifications, one for each side of the communications channel, and the second stage involves generation of the output traffic class 39 based on the time course of the two signal classifications.

Referring to FIG. 2 there is a block diagram of an embodiment of the first stage of the Traffic Classifier 20. The input 21 is the signal from one side of the Communications Channel 4. The output Signal Class 33 is an indication of the type of signal on input 21. An identical apparatus is applied for each side of the channel. The Line Length Compensator 22 is a slowly-adapted filter used to compensate for the high-frequency attenuation caused by long communication lines. The compensated signal 23 is passed to the Spectrum Classifier 24 for estimating the most likely signal class based solely on the local spectral characteristics. The Spectrum Classifier 24 may also output spectral analysis information 25 for use in adaptation of the Line Length Compensator 22. The Handshaking Detector 26 and the Tone Detector 28 specifically detect a number of standard facsimile and VBD handshaking signals. The Audible Network Signaling Detector 30 specifically detects audible network signaling such as dial tone and busy signal. Finally, the Signal Classifier 32 determines the output Signal Class 33 based on information gathered from the time course of the outputs of the Spectrum Classifier 24 and the three detectors (26, 28, 30).

The set of signal classes output from FIG. 2 depends on the application. This set typically includes zero or more classes from each of the following general categories: Voice, Facsimile, VBD, Audible Network Signaling, Facsimile Handshaking, VBD Handshaking, Silence, and Unknown.

Referring to FIG. 3 there is a block diagram of an embodiment of the second stage of the Traffic Classifier 20. The inputs 33A and 33B are signal classifications, one from each side of the Communications Channel 4, such as are derived in the first stage of the Traffic Classifier 20. The input signal classifications are mapped onto a set of intermediate classes 35A and 35B, which are then used in combination with the current Traffic Class 37 to update the output Traffic Class 39.

The set of intermediate classes conveyed over lines 35A and 35B of FIG. 3, and the set of traffic classes output on line 39 of FIG. 3, depend on what is required in the Regulator 60 to meet the needs of the application. These sets typically includes zero or more classes from each of the following general categories: Voice, Facsimile, VBD, Audible Network Signaling, Facsimile Handshaking, VBD Handshaking, Silence, and Unknown.

In order to configure the Traffic Classifier 20 for a particular application, it is necessary to define tables for mapping of signal classes onto intermediate classes as well as a table for updating the output Traffic Class 39 based on the Intermediate Classes 35A and 35B and preceding values of the Traffic Class 37. Certain applications also require that the signal class mapping process be dynamically altered when certain signal classes are observed. This provides a mechanism for allowing handshaking early in the call to influence traffic classifications throughout the remainder of the call.

Source Classifier 40

The Source Classifier 40 produces an output source class 59 that indicates which end of the Communications Channel 4 is generating traffic at any given point in time. One can not assume that signals on a given side of a communications channel were generated on that side, as cross-talk and echoes can cause significant leakage from one side to another. Source classification is typically a two-stage process, where the first stage involves derivation of two amplitude estimates, one for each side of a communications channel, and the second stage involves generation of the output source class 59 based on the two amplitude estimates.

Referring to FIG. 4 there is a block diagram of an embodiment of the first stage of the Source Classifier 40. The input 41 is the signal from one side of the Communications Channel 4. The output Amplitude Estimate 53 is an estimate of the average amplitude on one side of the Communications Channel 4. An identical apparatus is applied for each side of the channel. The Block Segmenter 42 and the Block Amplitude Estimator 44 combine to periodically produce Block Amplitude Estimates 45, which are estimates of the average amplitude of the signal for successive blocks of signal samples. The average of the square of all samples in a block is a suitable formula for estimating a block's amplitude. The remaining components of FIG. 4 define a specialized averaging process which rapidly increases the output Amplitude Estimate 53 when it is less than the Block Amplitude 45, and slowly decreases the output Amplitude Estimate 53 when it is higher than the Block Amplitude 45. The Multiplier 48 determines the rate of decline of the output Amplitude Estimate 53 when the Block Amplitude 45 drops.

Referring to FIG. 5 there is a block diagram of an embodiment of the second stage of the Source Classifier 40. The inputs 53A and 53B are amplitude estimates, one from each side of the Communications Channel 4, such as are derived in the first stage of the Source Classifier 40. The output Source Class 59 indicates which side of the Communications Channel 4 is generating the traffic. The result is based on the notion that the signal originates from the side of the channel that has the largest estimated amplitude.

Regulator 60

The Regulator 60 causes conditional imposition of prescribed actions based on the Traffic Class 39 and the Source Class 59. It is configured to impose the prescribed actions when specified combinations of traffic classes and source classes occur, or when different specified combinations of traffic classes and source classes fail to occur within a specified period of time. These specified combinations may change over the course of policing as a consequence of the passage of time or the observance of specific combinations of traffic classes and source classes. The prescribed actions may comprise of altering the signal on the Communications Channel 4 (dashed lines 67), or sending of requests for prescribed actions to separate devices within the network (dotted line 69). The prescribed action may be to impose a recorded voice message, to terminate the call, to apply special billing functions, or other actions.

The Regulator 60 is typically implemented by mapping the Traffic Class 39 and Source Class 59 onto a set of generic categories such as "Good", "Maybe", "Bad" and "Silence", as well as two special categories called "Ignore" and "Freeze". Intervention does not occur when "Good" traffic is observed, but it is imposed when "Bad" traffic is observed. The "Maybe" category is equivalent to either "Good" or "Bad", depending on the configuration. The "Silence" category may or may not elicit intervention, depending on the requirements of the application.

The "Ignore" category and the "Freeze" category serve special functions in the Regulator 60. When a traffic class is mapped onto "Ignore", it has no effect on the actions of the Regulator 60. When a traffic class is mapped onto "Freeze", the Regulator 60 is disabled until a different traffic class is observed. In particular, actions that would normally occur when certain timers expire are deferred until the system is released from its frozen state.

Certain applications require refinements to the Regulator 60, such as inclusion of timers that are started (or stopped) when the Traffic Class 39 or Source Class 59 changes. This allows prescribed actions to be triggered when a given traffic class remains unaltered for a specified period of time. Other timers may be included for triggering of prescribed actions a specified period of time after the call starts. Other applications may require maintenance of running tallies of the time spent in each traffic class (and source class), or records of the sequence of observed traffic classes (and source classes).

It is generally desirable to provide mechanisms for partially disabling the Regulator 60. For example, the prescribed actions of the Regulator 60 can be disabled so that tests of policing functions can be performed without disturbing customers. The Regulator 60 is then operative for collection of data on the degree to which said prescribed actions would be imposed if they were active.

A preferred embodiment of the Regulator 60 operates as follows. An initial period of grace is allowed at the start of a call during which all traffic is acceptable, i.e., prescribed actions are never imposed during the grace period. After the grace period expires, the only acceptable class of traffic is facsimile, with all other traffic classes leading to imposition of a voice message and forced call termination. An alternative preferred emodiment operates to impose a voice message and terminate the call whenever voice is observed after the grace period. These preferred embodiments see application in policing of a "facsimile-only" telephone service and an "anything-but-voice" telephone service, respectively. Note that the grace period is an important element of the Regulator 60, because legitimate facsimile calls may be set up manually.

Network Controller 80

The Network Controller 80 represents the interface with control entities of the telephone network to provide control, management and data collection functions. Configuration control, reporting of alarms, detection of failures and execution of periodic system integrity checks are coordinated by the Network Controller 80. Periodic reports about the properties of traffic on the communications channel, and about the policing activities of the invention, are gathered by the Network Controller 80 and saved for future inspection. Such periodic reports are a direct outgrowth of the need for periodic system integrity checks, whereby the Network Controller 80 monitors the invention to ensure that policing functions are being applied appropriately. Finally, the Network Controller 80 may supply signaling information or implement policing actions when performance of such functions are not limited to operations performed on the Communications Channel 4.

The embodiment of the invention dedicated to control of answer supervision fraud is called the no-answer-supervision control platform (NASCP). Referring to the block diagram in FIG. 1, the various components of the NASCP perform the following functions:

1. The Channel State Detector 10 activates policing when only one side of a channel is off-hook, and deactivates policing at other times.

2. The Traffic Classifier 20 determines whether or not the channel is carrying signals generated by customers. The processing is consistent with FIG. 2 and FIG. 3, and descriptions thereof. Further details are provided in the sequel.

3. The Source Classifier 40 determines which side of the channel is generating the traffic. This is important in the NASCP because customer-generated traffic frequently appears on the off-hook side of a channel before a call is answered. For example, a person may talk to someone else while they are waiting for a call to be answered. The processing is consistent with FIG. 4 and FIG. 5, and descriptions thereof. The multiplier 48 in FIG. 4 is set such that the Amplitude Estimates 53 are averaged over a number of seconds. This ensures that the derived Source Class 59 does not change during relatively short silent periods such as are encountered in the "telephone ringing" signal, during silent periods in a voice conversation, or during page breaks within facsimile transmissions.

4. The Regulator 60 waits for a configurable "grace period" after being enabled by the Channel State Detector 10, and then acts to force both sides of the channel to an off-hook state when significant amounts of customer-generated traffic are observed emerging from the side of the channel that is apparently on-hook. The Regulator 60 also forces both sides of the channel to an off-hook state when the channel has been in a one-side-off-hook state for an inordinate period of time. The act of forcing both sides of the channel to an off-hook state causes switches in the network to initiate billing. For networks operated in accordance with what is commonly called channel associated signaling (CAS) protocols, the hook-state forcing functions are implemented by altering signaling information carried within the communications channel, i.e., dashed lines 67 in FIG. 1. For networks operating in accordance with what is commonly called Common Channel Signaling (CCS) protocols, the hook-state forcing functions are implemented by triggering the generation of signaling messages over a separate signaling network, i.e., dotted line 69 in FIG. 1. Other functions, such as imposition of a voice message or call termination, can also be performed by the Regulator 60 if needed by the network service provider.

Referring to FIG. 6 there is an overview of network-generated signals that can occur at various points in a telephone network when only one side of a channel is off-hook. The Traffic Classifier 20 in the NASCP needs to specifically detect only a subset of these signals, as some of them only appear at certain points in the network, while others only appear under circumstances that arise when both sides are off-hook. The following comments apply:

1. SS4 and SS5 Signaling Tones: In older network equipment, many call administration functions are performed by passing high-frequency tone pulses. Single-component and double-component tone pulses with component frequencies of 2040 Hz, 2400 Hz and/or 2600 Hz are used. These signals do not appear where a NASCP is logically located in today's networks.

2. Low Frequency Audible Signaling Tones: A wide variety of audible signaling tones are defined to provide customers with feedback on the status of their call. Standards suggest a "precise tone plan" for such signals, where all signaling tones are defined as one-component or two-component signals whose component frequencies are 350 Hz, 440 Hz, 480 Hz or 620 Hz. While the precise tone plan is not universally adhered to, it is fair to say that Low Frequency Audible Signaling tones are comprised of either one or two sinusoidal components, each with a frequency lower than about 620 Hz. A number of these tones, such as the Dial Tone, the Ringing Tone or the Busy Tone, are common for relatively long periods of time during a one-side-off-hook condition. Hence, the NASCP must separately classify such signals.

3. Recording Warning Tone (RWT): The RWT is used to inform customers that a conversation is being recorded. The NASCP does not need to detect RWT because, if a conversation is in progress, the call will have advanced to a state where both sides are off-hook.

4. Payphone Recognition Tone (PRT): The PRT is used to identify a called phone as a payphone so that operators can prevent fraud on collect calls. The PRT is normally generated immediately after the called party answers the call and as such is not a concern for the NASCP. The PRT can also be used to identify when a caller is a payphone, in which case it may appear during the one-side off-hook interval. However, many administrations do not use the PRT in this manner, and when it is used it will appear to emerge from an off-hook source from the point of view of the NASCP. Therefore, the NASCP does not need to actively detect the PRT.

5. Coin Deposit Tone (CDT): The CDT is a combination of 1700 Hz and 2200 Hz at (nominally) the same amplitude. Separate classification of CDT by the NASCP is not necessary, as people do not need to deposit coins when calling 1-800 numbers, which is the main area where answer supervision fraud occurs.

6. Special Information Tone (SIT): The SIT is used to inform a caller of unusual reasons for call failure. The SIT is usually followed by a short recorded voice message.The NASCP must accept SIT, and voice messages after SIT, as being valid network-generated signals. This allows for network-generated voice messages to be inserted in accordance with common practice.

7. Receiver Off-Hook (ROH) Howler Signal: ROH is generated when one of the participants in a call fails to hang up. Since in this circumstance the call has already been completed, the NASCP need not separately classify the ROH signal. ROH can also be generated when a customer lifts up the handset but fails to dial. In this case the "call" is unlikely to ever pass through the NASCP. The conclusion is that the NASCP does not need to take special measures to detect the ROH signal.

8. Multi-Frequency Signaling (MF): When channel associated signalling is employed, MF tones are used within the network for communicating called numbers and calling numbers. Such tones occur in a relatively short burst near the start of a call. The NASCP can thus ignore MF by simply delaying the activation of policing by a few seconds.

9. Dual Tone Multi-Frequency (DTMF) for Dialing: DTMF does not normally occur for call setup within the network. However, such signals may occur if the NASCP is located between the PBX and the network. Like MF, one can assume that network-generated DTMF occurs in a short burst near the start of the call.

10. Other DTMF: DTMF generated by the customer after the number is dialed should be lumped with Voice and VBD as illegal activity when only one side is off hook. That is, the NASCP should treat such DTMF as if it were Voice or VBD.

By the discussion presented here, the Traffic Classifier 20 in the NASCP needs to actively detect the low-frequency audible signaling tones, the special information tone, and a short voice message after the special information tone. Other network signals may also need to be detected, depending on the practices of the telecommunications service provider.

By interpreting voice after SIT as a network-generated signal, a means has in principle been created for defeating the NASCP by repeated insertion of SIT into the call. However, such action would require complicity of both parties in accepting periodic insertion of SIT. Callers of 1-800 numbers are not likely to find this acceptable. Owners of 1-800 numbers will also not be eager to explain to customers that they are inserting the SIT for the purpose of fraud. Nonetheless, network administrators may prefer to disable this feature of the NASCP, or to introduce additional constraints on the allowable frequency and duration of SIT messages passing through the NASCP.

While this invention has been described with reference to illustrative embodiments, this description is not intended to be construed in a limiting sense. Various other embodiments of the invention will be apparent to persons skilled in the art upon reference to this description. It is therefore contemplated that the appended claims will cover any such modifications of embodiments as fall within the true scope of the invention.