Fraud Detection in International Calls Using Fuzzy Logic

Fraud Detection in International Calls Using Fuzzy Logic Hussein M. Marah Faculty of Information Technology Misurata University Misurata, Libya Osama Mohamed Elrajubi Faculty of Information Technology Misurata University Misurata, Libya Abdulla A. Abouda Almadar Aljadid Company Research and Development Office Misurata, Libya Abstract Fraud is a problem that affects operators and telecommunication companies all around the world. One of the most known fraud is the bypass fraud, which is used in international calls in order to avoid access charges and making profits. This kind of fraud causes severe losses in revenue to operators with other negative side effects. In this paper a new fraud detection technique is proposed. The proposed technique depends on user profiling and using fuzzy logic. Fuzzy logic was used in decision making process by utilizing fuzzy logic membership function. A real database from mobile operator company Almadar Aljadid in Libya is used in this investigation. Five features are extracted and employed as detection patterns in the proposed technique. The five features or detection patterns are, subscriber s mobility, incoming to outgoing calls ratio, suspicious cell activity, irregular calls, and service type. Keywords bypass fraud; international calls; fraud detection technique; user profiling; fuzzy logic; detection patterns. I. INTRODUCTION Following the huge growth in telecommunication networks in the last years, which became so important part in our lives, the service providers and telecommunication companies face a new big challenge, fraud with all different types. That was spreading so fast with millions of dollars profits around the world. Generally, Fraud in telecommunications networks can be characterized by fraud conditions, which essentially describe how the fraudster gained the illegitimate access to the network [1]. The problem of the fraudulent use of mobile phones is a common thing to communication service providers which causes billions of dollars losses in annual revenue. By definition, fraud in communication networks can be defined as the illegal access to the network and the use of its services with no intention to pay service charges or making money by using these services, while fraud detection is referred to as a try to detect illegal usage of a communication network [2]. However telecommunication operators worldwide have lost a significant amount of revenue losses caused by bypass fraud which often called subscriber identity module (SIMbox) fraud. This loss was estimated to be ($2 billion) in 2009, and then increased more than %44 in 2011 ($2.8 billion) according to Communications Fraud Control Association (CFCA) Fraud Survey 2011 [3]. In addition to financial losses, fraud may cause danger, loss of service, loss of customer confidence, hurting reputation of network operators and may threaten national security of the affected country. These reasons were the main motivations to do this work in trying to put limits for this problem and protect operators against the fraudsters. Although some revenue assurance and fraud management vendors provide detection fraud services, but the large amount of daily cellular traffic, advanced technologies used by fraudsters and inability to find definitive solution, all these obstacles make finding a good solution is extremely challenging [4]. Therefore, it is believed that with the help of improved fraud detection models and developing new techniques, fraudulent activities in mobile communication networks can be exposed and prevented, and this would be beneficial to the network operators to minimize the losses [2] [5]. The common approaches or techniques that used to combat against bypass frauds have been the use of monitoring calling patterns and profiles through fraud management systems (FMS) and the use of test call generators (TCG). Both approaches, having their own set of merits in terms of accuracy, coverage and flexibility, also suffer from drawbacks which make the use of any individual technique against bypass fraud, insufficient [3]. In this work we utilize user profiling approach which depends on analyzing the subscriber s (SIMs) activity and behavior based on detection patterns, then using fuzzy logic in

decision making process. Based on the fuzzy logic results we decide that certain SIM card is suspicious one. This paper is organized into four sections. Section II overview bypass fraud in mobile networks and illustrates it with basic example, sections III propose a detection technique based on specific approach, explain methods and theories that used in this technique, section IV reviews papers for previous studies in same field, and section V concludes the paper. II. BYPASS FRAUD IN MOBILE NETWORKS The development of the telecommunication and technology, and the big size of telecom market that found very attractive to fraudsters, the traditional types of fraud has been replaced with more complex ways of frauds that was spread too fast in the world. Types of fraud can be divided into fraud in traditional networks, this type has many ways such as subscription fraud, which is the signing up for a service using fake or stolen identification, with no commitment of paying the bills. And other types such as SIM cloning, premium Rate Service (PRS) fraud, internal fraud, dealer fraud, roaming fraud, calling card fraud, PBX fraud and fraud in PSTN [2] [3]. The other type is fraud in Voice over IP (VoIP) networks which can be done by using VoIP technique. As example of this type: Arbitrage fraud, call transfer fraud, location route number (LRN) fraud and bypass fraud. In this work we focus on bypass fraud which is the most type of fraud used in international calls [5] [6]. Bypass fraud also is also known to as interconnect fraud, or GSM VoIP gateway fraud and Subscriber Identity Module box (SIMbox) fraud. Generally, bypass fraud route utilizes a VoIP gateway and an attached GSM Gateway (SIMbox) in the destination country [7]. SIMbox devices are telecommunication devices that can install large numbers of SIM cards. SIMbox uses VoIP technologies to enable international mobile calls to be routed through VoIP directly into a relevant GSM network [6]. This scenario requires that the fraudsters have access to advanced technology. Bypass fraud uses several of least cost call termination techniques like SIMboxes to bypass the legal call interconnection and diverting international incoming calls to "on" or "off" network (GSM /CDMA) calls with VoIP or satellite gateway, which is making international calls appear to be local calls. Thus avoid paying charges for international calls termination which operators and government regulators are entitled to [3] [6]. Fig. 1. Basic Bypass fraud structure [3]. Figure 1 shows an example of how SIMbox bypass fraud occurs in international phone calls. When the caller in A party make international call to B party, the legitimate case, once A dials B s number, the call is routed through the cellular infrastructure of operator A to a least cost route (LCR) carrier. Based on an agreement between operator B and the LCR carrier, the call is routed to operator B s cellular core network. The LCR carrier pays operator B a fee in order to have the call terminated. Then the call is routed through the operator B s cellular infrastructure and is delivered to called party [4]. The fraud occurs when a fraudulent LCR carrier hijacks A s party call and forwards it to called party in country B over the Internet, e.g. via VoIP. Then in country B, a SIMbox (an associate of the fraudulent LCR carrier) transforms the incoming VoIP flow into a local mobile call to called party, and the operator in country B loses the termination fee for the hijacked call [4]. SIMbox generate important revenue losses by bypassing official interconnections, causing issues for many mobile operators. SIMboxes also have a negative impact on call quality and customer satisfaction, due to call redirection, inaccessible services and missing callbacks and compromise the cellular network infrastructure by overloading local base stations serving these devices [3][4]. If a fraudster uses his own network s connections to terminate the bypassed calls (on-net bypass), this ensures maximum international to national terminating charge profit margins for the fraudulent parties involved in the fraud business. As the on-net calls are expected to provide the least national calling rates, some modern bypass equipment (SIMboxes, computer programs etc.) scan the terminating party numbers and originate calls only from those connections which belong to the same operator s network as the terminating party [3].

III. THE PROPOSED TECHNIQUE A. Fraud Detection Approaches Techniques used for fraud detection fall into two primary classes: statistical techniques and artificial intelligence [8]. Statistical data analysis techniques such as: data preprocessing, calculation of various statistical parameters, clustering and classification and computing user profiles. Artificial Intelligence such as: machine learning techniques, neural networks, pattern recognition to detect patterns of suspicious behavior, decision theory, link analysis and fuzzy logic. The proposed technique to deal with this problem is based on using user profiling approach and fuzzy logic (FL) for decision making process. This technique has been designed and implemented in a program. B. Data Acquisition Telecommunication companies need an effective and accurate billing system to be able to assure their revenue. Billing systems process the usage of network equipment that is used during the service usage into a single Call Detail Record (CDR). For that, the employed method in this work for data collection is by getting the call detail record (CDR) from telecommunication company. A sample of real call detail record (CDR) from Almadar Aljadid Company, a mobile operator in Libya was obtained and analyzed. We don t know if contains fraud or not. The CDR contains approximately 65 fields, only 11 fields were used in the detection process. The fields are shown in table 1. CDR Field Time Date Duration Call identification number Originating number Terminating number Service type Originating IMSI Terminating IMSI Table. 1. Call Detail Record fields [9] Description Time of a call Date of a call Call duration Identifies the call component Phone number of a caller party Phone number of a called party Mobile originated/terminated Call or SMS International Mobile Subscriber Identity for calling subscriber International Mobile Subscriber Identity for called subscriber First Location Information Last Location Information C. Detection Patterns Contains information about the first cell information. Contains information about the last cell information at disconnection. Five detection patterns were extracted from the sample of CDR. These five patterns are valuable in detection process. These detection patterns are as following [10]: 1. No or low mobility: this pattern represents the number of calls for subscribers without mobility. 2. Ratio of incoming to outgoing calls: this pattern represents the number of outgoing calls for subscribers with no incoming calls. 3. Use only voice service (no usage of SMS, MMS, GPRS, etc.): this pattern represents the number of outgoing voice calls for subscribers without using other services such as (SMS, MMS, GPRS sessions, etc.). 4. Suspicious activity in close proximity (hot cell site calling): This pattern represents the number of subscribers that they make voice calls within the same location (cell site). 5. Calls during irregular hours, unusual night long calls: this pattern is represents the number of irregular voice calls (long midnight calls) for subscribers. These patterns are implemented and thresholds are set by the operators analysts. The methods are continually monitoring the network traffic and keep statistics for a given time period. If the threshold is reached, a possible fraud situation is detected. Then the analysts decide on each situation if this is a real fraud situation and what actions to take by the operator [11]. We extracted detection patterns from CDR sample by using structured query language (SQL) queries, then we found the (Max, Min) values for each detection pattern, the (Max, Min) values were used for designing the membership function and fuzzy rules by using membership function equation, as illustrated in Figure 2. D. Fuzzy Logic The fuzzy set theory is taking the same logical approach as what people have been doing with the classical set theory. In the classical set theory, the two-valued characteristic function has been defined and adopted. In the fuzzy set case; a multivalued characteristic function (the membership function) has been chosen and fixed [12]. Fuzzy logic is a form of manyvalued logic; it deals with reasoning that is approximate rather than fixed and exact. Compared to traditional binary sets (Classical logic) that only takes just two values (where

variables may take on true or false values 0,1) fuzzy logic variables may have a truth value that ranges in degree between 0 and 1 known as a membership function [13]. In this work, we used fuzzy logic to make the decision (determine which SIM cards are used in fraud). Membership Function (MF): A fuzzy set A is a subset of the universe of discourse X that admits partial memberships. The fuzzy set A is defined as an ordered pair A = {x, μ(x)}, where x Є X, and 0<= μa(x) <= 1. The membership function μa(x) describes the degree to which the object x belongs to the set A. μa(x) = 0 represents no membership, and μa(x) = 1 represents full membership [13]. Fuzzy Rules: Human beings make decisions based on rules. Although, we may not be aware of it, all the decisions we make are all based on computer like if-then statements. If the weather is fine, then we may decide to go out for example [14]. A fuzzy system is a collection of membership functions and rules that are used to reason about data [12]. A fuzzy rule can be defined as a conditional statement [15]. As the following form: IF x is A THEN y is B Where x and y are linguistic variables, and A and B are linguistic values determined by fuzzy sets on the universe of discourses X and Y, respectively. In classical rule-based systems, if the rule antecedent (the condition) is true, then the consequent (the result) is also true. In fuzzy systems, where the condition is a fuzzy statement, all rules are corrected to a defined range, i.e. they are partially correct. If the antecedent is true to some degree of membership, then the result is also true to same degree [16]. For example, rules in a fuzzy form can be represented as: Rule: 1 IF THEN Rule: 2 IF THEN "Number of calls at night" is "little" "The result of test" is "SIM card is legal" "Number of calls at night" is "much "The result of test" is "SIM card is fraud" In Rule 1: the condition is fuzzy. So the result of condition (SIM card is legal) is correct in a ratio which is equal to the membership of the variable "number of calls at night" in the set "little". Also In Rule 2: the condition is fuzzy, so the result of condition (SIM card is fraud) is correct in a ratio which is equal to the membership of the variable "number of calls at night" in the set "much". The linguistic variable "number of calls at night" also has the range (the universe of discourse), but this range may include fuzzy sets, such as small, medium and large. The universe of discourse of the linguistic variable "Result of test" can include fuzzy sets such as very correct, correct and incorrect. Thus fuzzy rules related to fuzzy sets. The consequent of a fuzzy rule can also include multiple parts [17]. Fig. 2. Flowchart of detection patterns extraction process. Figure 2 shows the processes of extraction detection patterns from CDR and how designing membership function for each. The fuzzy system in this technique used triangular membership function for all detection patterns, by knowing the (Max, Min) values for detection patterns which extracted from database (CDR) and then calculate the membership value by using the next equation (1): Xi = Value Min Max Min Where (Xi) is the membership function value of one of detection patterns for certain subscriber, Min is the minimum value for certain detection pattern, Max is the maximum value for certain detection pattern. If any subscriber has all detection patterns with high membership function value (y) by using the next equation (2), it can be considered as potential case of fraud.

x1 + x2 + x3 + x4 + xn y = n Where (y) is sum of membership function (MF) for all detection patterns (x1, x2, x3, x4, x5) divided by (n), the number of patterns which found for this subscriber. The final result is fraud score (y), its value between (0 1) and represent the fraud membership function of certain subscriber which has all or some detection patterns depending founded patterns. also he should set the thresholds for fraud value (accuracy level). Then he selects specific or all patterns that he want to know if this SIM card has and click on the search button. If this SIM card has fraud score MF value more than the entered threshold value, then the program will consider it as possible case of fraud and will shows information and history of calls for this SIM card. This program can be very helpful for the mobile operators to verify possible SIMbox fraud. Figure 4 shows the graphical user interface of the program and results. E. Detection Technique Processes The general proposed technique and its verification processes are illustrated in figure 3. Fig. 4. Graphical User Interface (GUI) of the program IV. RELATED WORK Hollmén, Jaakko 2000. User profiling and classification for fraud detection in mobile communications networks [18]. This paper used user profiling and classification techniques, neural networks and probabilistic models are employed in learning usage patterns from call data. Fig. 3. The general diagram of the proposed technique We developed program with friendly user interface that designed and programmed by using C# programming language in order to implement the detection technique, we used Microsoft Visual Studio 2008 as integrated development environment (IDE), and then connected to Microsoft SQL Server 2008 that used to managing and processing input data (CDR). The analyzer who will be using the program should enter the IMSI number for any SIM card that he wants to verify and Rosas, Eugénio, and Cesar Analide 2009. Telecommunications Fraud: Problem Analysis-an Agentbased KDD Perspective [11]. The paper proposed an approach, based on the profiling and KDD (Knowledge Discovery in Data) techniques, supported in MAS (Multiagent System). Elmi, Abdikarim Hussein, Subariah Ibrahim, and Roselina Sallehuddin 2013. Detecting SIMbox fraud using neural network [19]. In this paper a supervised learning method was applied using Multi-layer perceptron (MLP) as a classifier, and a total of nine features used in identifying SIMbox fraud, subscriber are derived from the attributes of the Customer Database Record (CDR), Artificial Neural Networks (ANN) had shown classification accuracy of 98.71 %. Murynets, Ilona, Michael Zabarankin, Roger Piqueras Jover, and Adam Panagia 2013. Analysis and Detection of

SIMbox Fraud in Mobility Networks [4]. The paper proposed novel classifiers for fraudulent SIMbox detection in mobility networks, fraudulent SIMboxes are observed to have static physical locations and to generate disproportionately large volume of outgoing calls, and the operator s fraud department confirmed that the algorithm succeeds in detecting new fraudulent SIMboxes. V. CONCLUSION We have analyzed traffic of mobile network (CDR) for a certain part of time to profiling and knowing the behavior of users in order to get a detection patterns (features) for these users (SIMs). After that, we have found a (Max, Min) values for every detection pattern, then we used these values in fuzzy logic membership equation to get the membership function for any SIM card in every pattern, to know if this SIM card perhaps a suspicious case of fraud or not based on value of membership function for all patterns (fraud score), all these processes was implemented and processed in program. The results of the program depend on input database (CDR), is it contains fraud or not. The result of fuzzy logic membership function (MF) of patterns depends on extracted values from CDR for each detection pattern (Max, Min). We had used the program and we got some results (fraud score) for SIMs cards which can be considered as fraud, but we don t have fraud data that can be used to test the results of the program, and we couldn t test or verify the results by the company s fraud department by using test call or other verification method to confirm the fraud happening in these SIMs. By using profiling with fuzzy logic in this technique can be more flexible and reliable in dealing with huge amount of input data (CDR). The profiling process can be updated every now and then, and the values of pattern (Max, Min) can be changed depending on input data (CDR) and accuracy and efficiency of the program s results. For the future work we will add more detection patterns (features) and giving weights for each of them based on its importance and effectiveness for improving the performance and accuracy of the technique. ACKNOWLEDGMENT We are grateful to the office of Research and Development (R&D) in Almadar Aljadid for Telecommunication in Libya to their support and cooperation in doing this research work. REFERENCES [1] F. N. Ogwueleka, fraud detection in mobile communications networks using user profiling and classification techniques. Journal of science and technology, vol. 29, no. 3 (2009), pp. 31-42. [2] Aranuwa FO (2013). Hybridized intelligent data analysis model for fraud detection in mobile communication networks. Acad. J. Sci. Res. 1(5): 082-089. [3] Subex Inc. White Paper Bypass Fraud- Are you getting it right?. Available at: http://www.subex.com. [4] Murynets, Ilona, Michael Zabarankin, Roger Piqueras Jover, and Adam Panagia. "Analysis and Detection of SIMbox Fraud in Mobility Networks." [5] YacineRebahi, Jens Fiedler, FabricioGouveia. SCAMSTOP: Scams and Fraud Detection in Voice over IP Networks, FraunhoferFokus, INRIA, TEIMES, PDMFC, Telio, VozTelecom.8-13, 2010. [6] TransNexus, Inc. Introduction to VoIP Fraud White Paper. (2012). Available at: http://www.transnexus.com. [7] Three Ways to Reduce Exposure to Bypass Fraud, The Risk Management Group, May 2012. Available at: http://www.lavastorm.com [8] G.K. Palshikar, The Hidden Truth Frauds and Their Control: A Critical Application for Business Intelligence, Intelligent Enterprise, vol. 5, no. 9, 28 May 2002, pp. 46 51 [9] Ericsson Gmbh 2012. Common Charging Output Asn.1 Result. 1/155 19-Fay 112 040/11 Uen A. 6-12,104-150, 2012 [10] Nokia Siemens Networks, Battling illegal call operations with Fraud Management Systems, (2-10), December 09, 2008. [11] Rosas, Eugénio, and Cesar Analide. "Telecommunications Fraud: Problem Analysis-an Agent-based KDD Perspective." Aveiro: EPIA (2009). [12] Tanaka, Kazuo. "An introduction to fuzzy logic for practical applications." (1997). [13] L. A. Zadeh. "Fuzzy Sets". Information and Control 8 (3). 338 353, 1965. [14] Cádiz, Rodrigo F. "A fuzzy logic model for compositional approaches to audio-visual media." Proceedings of the International Computer Music Conference. 2004. [15] Dixit, Prakash Mahadeo, and Uday S. Dixit. Modeling of metal forming and machining processes: by finite element and soft computing methods. Springer, 2008. [16] Ponce-Cruz, Pedro, Fernando D. Ramírez-Figueroa, and Fernando D. Ramírez-Figueroa. Intelligent control systems with LabVIEW. Vol. 216. London, UK:: Springer, 2010. [17] Negnevitsky, Michael. Artificial intelligence: a guide to intelligent systems. Pearson Education, 2005. [18] Hollmén, Jaakko. User profiling and classification for fraud detection in mobile communications networks. Helsinki University of Technology, 2000. [19] Elmi, Abdikarim Hussein, Subariah Ibrahim, and Roselina Sallehuddin. "Detecting sim box fraud using neural network." IT Convergence and Security 2012. Springer Netherlands, 2013. 575-582.