Search

CA-3178322-C - CALL CLASSIFICATION THROUGH ANALYSIS OF DUAL-TONE MULTIFREQUENCY (DTMF) EVENTS

CA3178322CCA 3178322 CCA3178322 CCA 3178322CCA-3178322-C

Abstract

Systems, methods, and computer-readable media for call classification and for training a model for call classification, an example method comprising: receiving DTMF information from a plurality of calls; determining, for each of the calls, a feature vector including statistics based on DTMF information such as DTMF residual signal comprising channel noise and additive noise; training a model for classification; comparing a new call feature vector to the model; predicting a device type and geographic location based on the comparison of the new call feature vector to the model; classifying the call as spoofed or genuine; and authenticating a call or altering an IVR call flow.

Inventors

  • Nick GAUBITCH
  • Scott Strong
  • John Cornwell
  • Hassan KINGRAVI
  • David Dewey

Assignees

  • PINDROP SECURITY, INC.

Dates

Publication Date
20260505
Application Date
20170801
Priority Date
20170519

Claims (20)

  1. CLAIMS What is claimed is: 1. A computer-implemented method comprising: receiving, by a computer, a dual-tone multifrequency (DTMF) tone associated with a phone call; generating, by the computer, an ideal DTMF tone corresponding to the received DTMF tone, wherein the ideal DTMF tone is noise-free; estimating, by the computer, additive noise in the received DTMF tone based on the difference between the received DTMF tone and the ideal DTMF tone; generating, by the computer, a feature vector based upon the additive noise; and executing, by the computer, a machine learning model on a difference between the received DTMF tone and the ideal DTMF tone to classify the phone call, wherein executing the machine learning model comprises feeding, by the computer, the feature vector to the machine learning model.
  2. 2. The computer-implemented method of claim 1, wherein the computer classifies the phone call as fraudulent or non-fraudulent.
  3. 3. The computer-implemented method of claim 1, wherein the received DTMF tone is received as an analog audio signal.
  4. 4. The computer-implemented method of claim 1, wherein the received DTMF tone is received as an audio packet.
  5. 5. The computer-implemented method of claim 4, wherein the audio packet is a Real-time Transport Protocol (RTP) audio packet.
  6. 6. The computer-implemented method of claim 1, further comprising: receiving, by the computer, a plurality of DTMF tones associated with a plurality of phone calls; generating, by the computer, a plurality of feature vectors based on the differences between each of the plurality of DTMF tones and an ideal DTMF tone; and training, by the computer, the machine learning model on the plurality of feature vectors. 22 Date Re9ue/Date Received 2022-10-03
  7. 7. The computer-implemented method of claim 1, further comprising: estimating, by the computer, channel noise in the received DTMF tone based on the difference between the received DTMF tone and the ideal DTMF tone; generating, by the computer, a second feature vector based upon the channel noise; and executing, by the computer, the machine learning model on the difference between the received DTMF tone and the ideal DTMF tone to classify the phone call, wherein executing the machine learning model comprises feeding, by the computer, each feature vector to the machine learning model.
  8. 8. The computer-implemented method of claim 1, wherein the computer is associated with an futeractive Voice Response (IVR) system and the received DTMF tone is received in response to IVR prompts.
  9. 9. A system comprising: a non-transitory storage medium storing a plurality of computer program instructions; and a processor electrically coupled to the non-transitory storage medium and configured to execute the plurality of computer program instructions to: receive a first dual tone multi frequency (DTMF) tone associated with a first phone call originating from a phone number; generating a first feature vector from the first DTMF tone; receive a second DTMF tone associated with a second phone call originating from the phone number; generate a second feature vector from the second DTMF tone; and execute a machine learning model that is based on the first feature vector on the second feature vector to determine whether a device type from which the second phone call originated matches the device type from which the first phone call originated. 23 Date Re~iue/Date Received 2024-05-09
  10. 10. The system of claim 9, wherein the processor is configured to further execute the plurality of computer program instructions to indicate that the first phone call is spoofed when the determined device type does not match an expected device type for the second phone call.
  11. 11. The system of claim 9, wherein the second feature vector is based upon at least one of a mean, a median, a variance, a standard deviation, a frequency, a wavelength, an amount of time, a coefficient of variation, or a percentile associated with the second DTMF tone.
  12. 12. The system of claim 9, wherein the processor is configured to further execute the plurality of computer program instructions to train the machine learning model based on a plurality of recordings of DTMF tones associated with a plurality of device types.
  13. 13. The system of claim 9, wherein the device type is at least one of a Voice over Internet Protocol (VoIP) phone, a smartphone, or a softphone.
  14. 14. A computer-implemented method comprising: receiving, by a computer, a first dual tone multi frequency (DTMF) tone associated with a phone call originating from a phone number and device type; generating, by the computer, a DTMF fingerprint associated with the phone number and the device type based upon the first DTMF tone, the DTMF fingerprint being a machine learning model; receiving, by the computer, a second DTMF tone associated with a second phone call originating from the phone number; generating, by the computer, a feature vector from the second DTMF tone; executing, by the computer, the machine learning model on the feature vector to determine whether the feature vector of the received second DTMF tone matches the DTMF fingerprint associated with the phone number; and in response to the computer determining that the feature vector of the second DTMF tone does not match the DTMF fingerprint associated with the phone number and the device type, indicating, by the computer, that the phone call is spoofed. 24 Date Re9ue/Date Received 2024-05-09
  15. 15. The computer-implemented method of claim 14, wherein the feature vector is based upon at least one of a mean, a median, a variance, a standard deviation, a frequency, a wavelength, an amount of time, a coefficient of variation, or a percentile associated with the second DTMF tone.
  16. 16. The computer-implemented method of claim 14, further comprising: in response to the computer determining that the fingerprint of the received DTMF tone matches the DTMF fingerprint associated with the phone number, indicating, by the computer, that the phone call is not spoofed.
  17. 17. The computer-implemented method of claim 14, further comprising training, by the computer, the machine learning model on a plurality of DTMF tones associated with the phone number to learn the DTMF fingerprint associated with the phone number.
  18. 18. The computer-implemented method of claim 14, wherein the computer is associated with an Interactive Voice Response (IVR) system and the received DTMF tone is received in response to IVR prompts.
  19. 19. A system comprising: anon-transitory storage medium storing a plurality of computer program instructions; and a processor electrically coupled to the non-transitory storage medium and configured to execute the plurality of computer program instructions to: receive a first dual tone multi frequency (DTMF) tone associated with a phone call originating from a phone number and device type; generate a DTMF fingerprint associated with the phone number and the device type based upon the first DTMF tone, the DTMF fingerprint being a machine learning model; receive a second DTMF tone associated with a second phone call originating from the phone number; generate a feature vector from the second DTMF tone; execute the machine learning model on the feature vector to determine whether the feature vector of the received second DTMF tone matches the DTMF fingerprint associated with the phone number; and in response to determining that the feature vector of the second DTMF tone does not match the DTMF fingerprint associated with the phone number and the device type, indicate that the phone call is spoofed. Date Re9ue/Date Received 2024-05-09
  20. 20. The system according to claim 19, wherein the processor is further configured to execute the plurality of computer program instructions to train the machine learning model on a plurality of DTMF tones associated with the phone number to learn the DTMF fingerprint associated with the phone number. 26 Date Re9ue/Date Received 2024-05-09

Description

CALL CLASSIFICATION THROUGH ANALYSIS OF DUAL-TONE MULTIFREQUENCY (DTMF) EVENTS CROSS-REFERENCE TO RELATED APPLICATIONS [0001] The present application is a division of CA Patent Application No. 3032807 filed August 1, 2017 and claims priority to U.S. Provisional Patent Application Ser. No. 62/370,135, filed August 2, 2016, to U.S. Provisional Patent Application Ser. No. 62/370,122, filed August 2, 2016 and to U.S. Non-Provisional Patent Application Ser. No. 15/600,625, filed on May 19, 2017. BACKGROUND [0002] Dual-tone multifrequency (DTMF) signaling conveys information over the telephone network. DTMF tones-commercially known as "touch-tones"-are often used to communicate a telephone number to a switch, but they are also becoming an important component in the growing use of Interactive Voice Response (IVR) systems. [0003] IVR systems are a common method for an initial interface with a user at a call center. Before (and if at all) a user is routed to an agent, the user may be prompted to enter some details that identify the user and the user's specific query. The entry is typically performed using the telephone keypad. [0004] There are sixteen differentDTMF tones (defining digits 0-9, #,*,and A, B, C, D) defined using combinations of eight different single-frequency tones. As telecommunication devices and protocols progress and develop, the definition for generating DTMF tones also changes depending on the device type. So-called "plain old telephone service" (POTS) landline phones, Global System for Mobile Communications (GSM) cell phones, and Voice over Internet Protocol (VOIP) phones all handle DTMF differently. Furthermore, as DTMF tones traverse the public switched telephone network (PSTN) network, they will be modified slightly due to noise and other effects due to the communication channel. In most cases, these modifications are gentle enough not to affect the DTMF detection algorithms that map the audio signal to its corresponding value ( e.g. 0- 9, #,*,and A, B, C, D). [0005] As recognized by the inventors, the audio signal of DTMF tones generated by a far end user will exhibit deviations from an "ideal" DTMF tone when observed at the near end of a call. This discrepancy will depend on the type of device used and on the relative geographical locations of the near and far end users. The ideal DTMF tone is known a priori, and by calculating various 1 Date Re9ue/Date Received 2024-05-09 statistical entities based on the difference between the ideal DTMF tone and the observed, the device type and the relative geographic location of a user can be provided. [0006] As recognized by the inventors, different makes and models of telephones, smartphones, and softphones often have uniquely identifiable DTMF tones. By monitoring the tones of a known device type, phone number, or user, future tones can be used to determine the device type or authenticity of the phone number or user. SUMMARY [0007] In general, one aspect of the subject matter described in this specification can be embodied in a computer-implemented method to classify a call, the computer-implemented method comprising: receiving dual-tone multifrequency (DTMF) information from a call; determining a feature vector based on the DTMF information; comparing the feature vector to a model; and classifying the call based on the comparison of the feature vector to the model. [0008] These and other embodiments can optionally include one or more of the following features. In at least one embodiment of the computer-implemented method to classify the call, the computer-implemented method to classify the call further comprises prompting, by an Interactive Voice Response (IVR) system, entry of the DTMF information. [0009] In at least one embodiment, the computer-implemented method to classify the call further comprises determining an ideal DTMF tone, wherein the determining the feature vector based on the DTMF information includes determining a feature based on the ideal DTMF tone. [0010] In at least one embodiment, the computer-implemented method to classify the call further comprises estimating channel noise in a DTMF tone, wherein the determining the feature vector based on the DTMF information includes determining a feature based on the channel noise. [0011] In at least one embodiment, the computer-implemented method to classify the call further comprises estimating additive noise in a DTMF tone, wherein the determining the feature vector based on the DTMF information includes determining a feature based on the additive noise. [0012] In at least one embodiment of the computer-implemented method to classify the call, the feature vector is a vector of features including at least one feature, and the at least one feature is based on at least one of a mean, a median, a variance, a standard deviation, a frequency, a wavelength, a duration, a coefficient of variation, or a percentile of DTMF information. 2 Date Re9ue/Date Received 2022-10-03 [0013] In at least one