Systems and methods for use in blocking of robocall and scam call phone numbers

Abstract

Telephone numbers that are associated with robocalls or scam calls can be automatically identified by a telephone network operator. The identified telephone numbers may be blocked from placing phone calls on the telephone network.

1 . A system for detecting anomalous call behavior in a telephone network, comprising:
 one or more processors for executing instructions; and   at least one memory for storing instructions, which when executed by at least one of the one or more processors configure the system to perform a method comprising:
 receiving a plurality of raw call log records; 
 generating processed call records by identifying and associating raw call log records relating to a same call; 
 classifying the processed call records using a model trained to identify phone numbers associated with anomalous call behaviour; 
 identifying a phone number associated with anomalous call behavior; and 
 labelling the phone number identified to be associated with anomalous call behavior. 
   
     
     
         2 . The system of  claim 1 , wherein the model trained to identify phone numbers associated with anomalous call behavior analyzes features of the processed call records comprising one or more of: a number of unique incoming calls, a number of unique outgoing calls, an incoming call rate, a call duration, a number of unique callees, and a start time of a call. 
     
     
         3 . The system of  claim 1 , wherein the model trained to identify phone numbers associated with anomalous call behavior assigns an anomaly score to each originating phone number in the processed call records, and identifying the phone number associated with anomalous call behavior is based on the anomaly score exceeding an anomaly score threshold. 
     
     
         4 . The system of  claim 1 , wherein the method provided by executing the instructions further comprises filtering phone numbers with a number of outgoing calls less than an outgoing call threshold. 
     
     
         5 . The system of  claim 1 , wherein the model trained to identify phone numbers associated with anomalous call behaviour is trained by performance tuning using one or more sources of verified anomalous phone numbers. 
     
     
         6 . The system of  claim 1 , wherein the model trained to identify phone numbers associated with anomalous call behaviour comprises an Isolation Forest model. 
     
     
         7 . The system of  claim 1 , wherein the method provided by executing the instructions further comprises blocking the phone number determined to be anomalous from making calls over the telephone network. 
     
     
         8 . The system of  claim 1 , wherein the method provided by executing the instructions further comprises:
 automatically calling the phone number identified to be associated with anomalous call behavior;   simulating a call to the phone number; and   recording a portion of the call.   
     
     
         9 . The system of  claim 1 , wherein the method provided by executing the instructions further comprises:
 generating a user interface including an indication of the phone number identified to be associated with anomalous call behavior;   providing the generated user interface to an investigator of the telephone network operator; and   receiving from the user interface a selection including the phone number for blocking.   
     
     
         10 . The system of  claim 1 , wherein the plurality of raw call log records are received from a plurality of network elements that connect the telephone network to end user equipment and to other telephone networks. 
     
     
         11 . A method for detecting anomalous call behavior in a telephone network comprising:
 receiving a plurality of raw call log records;   generating processed call records by identifying and associating raw call log records relating to a same call;   classifying the processed call records using a model trained to identify phone numbers associated with anomalous call behaviour;   identifying a phone number associated with anomalous call behavior; and   labelling the phone number identified to be associated with anomalous call behavior.   
     
     
         12 . The method of  claim 11 , wherein the model trained to identify phone numbers associated with anomalous call behavior analyzes features of the processed call records comprising one or more of: a number of unique incoming calls, a number of unique outgoing calls, an incoming call rate, a call duration, a number of unique callees, and a start time of a call. 
     
     
         13 . The method of  claim 11 , wherein the model trained to identify phone numbers associated with anomalous call behavior assigns an anomaly score to each originating phone number in the processed call records, and identifying the phone number associated with anomalous call behavior is based on the anomaly score exceeding an anomaly score threshold. 
     
     
         14 . The method of  claim 11 , further comprising filtering phone numbers with a number of outgoing calls less than an outgoing call threshold. 
     
     
         15 . The method of  claim 11 , wherein the model trained to identify phone numbers associated with anomalous call behaviour is trained by performance tuning using one or more sources of verified anomalous phone numbers. 
     
     
         16 . The method of  claim 11 , wherein the model trained to identify phone numbers associated with anomalous call behaviour comprises an Isolation Forest model. 
     
     
         17 . The method of  claim 11 , further comprising blocking the phone number determined to be anomalous from making calls over the telephone network. 
     
     
         18 . The method of  claim 11 , further comprising:
 automatically calling the phone number identified to be associated with anomalous call behavior;   simulating a call to the phone number; and   recording a portion of the call.   
     
     
         19 . The method of  claim 11 , further comprising:
 generating a user interface including an indication of the phone number identified to be associated with anomalous call behavior;   providing the generated user interface to an investigator of the telephone network operator; and   receiving from the user interface a selection including the phone number for blocking.   
     
     
         20 . The method of  claim 11 , wherein the plurality of raw call log records are received from a plurality of network elements that connect the telephone network to end user equipment and to other telephone networks.