Search

US-12621382-B2 - Call classification through analysis of DTMF events

US12621382B2US 12621382 B2US12621382 B2US 12621382B2US-12621382-B2

Abstract

Systems, methods, and computer-readable media for call classification and for training a model for call classification, an example method comprising: receiving DTMF information from a plurality of calls; determining, for each of the calls, a feature vector including statistics based on DTMF information such as DTMF residual signal comprising channel noise and additive noise; training a model for classification; comparing a new call feature vector to the model; predicting a device type and geographic location based on the comparison of the new call feature vector to the model; classifying the call as spoofed or genuine; and authenticating a call or altering an IVR call flow.

Inventors

  • Nick GAUBITCH
  • Scott Strong
  • John Cornwell
  • Hassan KINGRAVI
  • David Dewey

Assignees

  • PINDROP SECURITY, INC.

Dates

Publication Date
20260505
Application Date
20240531

Claims (20)

  1. 1 . A computer-implemented method comprising: obtaining, by a computer, via a remote computer dual-tone multi frequency (DTMF) information associated with a new phone call; generating, by the computer, a new call feature vector for the new phone call using the DTMF information of the new phone call; determining, by the computer, a fraud probability that the new phone call is fraudulent or genuine, based upon comparing the new call feature vector against one or more prior call feature vectors for one or more prior phone calls, each prior call feature vector generated based upon the DTMF information of a prior phone call corresponding to the prior call feature vector; and generating, by the computer, a user interface comprising an indicator of the fraud probability for the new phone call.
  2. 2 . The method according to claim 1 , further comprising providing, by the computer, the user interface having the fraud probability for display at the remote computer.
  3. 3 . The method according to claim 1 , further comprising, for each prior phone call of the one or more prior phone calls, generating, by the computer, the prior call feature vector using the DTMF information for the prior phone call.
  4. 4 . The method according to claim 1 , wherein each prior call feature vector is associated with a corresponding label indicating one or more characteristics of the prior phone call corresponding to the prior call feature vector, the method further comprising training, by the computer, a classifier model according to each of the prior call feature vectors and the associated label for each of the prior phone calls.
  5. 5 . The method according to claim 4 , further comprising generating, by the computer, one or more fingerprint models associated with a known caller by executing the classifier model on a set of prior call feature vectors generated using the DTMF information for one or more of prior phone calls associated with the known caller.
  6. 6 . The method according to claim 4 , further comprising classifying, by the computer, the new phone call as fraudulent or genuine by applying the classifier model on the new call feature vector generated for the new phone call.
  7. 7 . The method according to claim 1 , further comprising generating, by the computer, ideal DTMF information corresponding to the DTMF information received during an Interactive Voice Response (IVR) session of the new phone call, wherein the computer generates the new call feature vector for the new phone call based upon one or more differences between the ideal DTMF information and the DTMF information of the new phone call.
  8. 8 . The method according to claim 7 , further comprising estimating, by the computer, additive noise in the DTMF information of the new phone call based upon the difference between the ideal DTMF information and the DTMF information of the new phone call.
  9. 9 . The method according to claim 7 , further comprising estimating, by the computer, channel noise in the DTMF information of the new phone call based upon the difference between the ideal DTMF information and the DTMF information of the new phone call.
  10. 10 . The method according to claim 7 , further comprising, for each prior phone call: generating, by the computer, prior ideal DTMF information corresponding to the prior DTMF information received during a prior IVR session of the prior phone call; and generating, by the computer, the prior call feature vector for the prior phone call based upon one or more differences between the prior ideal DTMF information and the prior DTMF information of the prior phone call.
  11. 11 . A system comprising: one or more network interfaces configured to receive dual-tone multifrequency (DTMF) information for a plurality of calls associated with a plurality of phone numbers; and a processor configured to: obtain via a remote computer the DTMF information associated with a new phone call; generate a new call feature vector for the new phone call using the DTMF information of the new phone call; determine a fraud probability that the new phone call is fraudulent or genuine, based upon comparing the new call feature vector against one or more prior call feature vectors for one or more prior phone calls, each prior call feature vector generated based upon the DTMF information of a prior phone call corresponding to the prior call feature vector; and generate a user interface comprising an indicator of the fraud probability for the new phone call.
  12. 12 . The system according to claim 11 , wherein the processor is further configured to provide the user interface having the fraud probability for display at the remote computer.
  13. 13 . The system according to claim 11 , wherein the processor is further configured to, for each prior phone call of the one or more prior phone calls, generate the prior call feature vector using the DTMF information for the prior phone call.
  14. 14 . The system according to claim 11 , wherein each prior call feature vector is associated with a corresponding label indicating one or more characteristics of the prior phone call corresponding to the prior call feature vector, and wherein the processor is further configured to train a classifier model according to each of the prior call feature vectors and the associated label for each of the prior phone calls.
  15. 15 . The system according to claim 14 , wherein the processor is further configured to generate one or more fingerprint models associated with a known caller by executing the classifier model on a set of prior call feature vectors generated using the DTMF information for one or more of prior phone calls associated with the known caller.
  16. 16 . The system according to claim 14 , wherein the processor is further configured to classify the new phone call as fraudulent or genuine by applying the classifier model on the new call feature vector generated for the new phone call.
  17. 17 . The system according to claim 11 , wherein the processor is further configured to generate ideal DTMF information corresponding to the DTMF information received during an Interactive Voice Response (IVR) session of the new phone call, and wherein the computer generates the new call feature vector for the new phone call based upon one or more differences between the ideal DTMF information and the DTMF information of the new phone call.
  18. 18 . The system according to claim 17 , wherein the processor is further configured to estimate additive noise in the DTMF information of the new phone call based upon the difference between the ideal DTMF information and the DTMF information of the new phone call.
  19. 19 . The system according to claim 17 , wherein the processor is further configured to estimate channel noise in the DTMF information of the new phone call based upon the difference between the ideal DTMF information and the DTMF information of the new phone call.
  20. 20 . The system according to claim 17 , wherein the processor is further configured to, for each prior phone call: generate prior ideal DTMF information corresponding to the prior DTMF information received during a prior IVR session of the prior phone call; and generate the prior call feature vector for the prior phone call based upon one or more differences between the prior ideal DTMF information and the prior DTMF information of the prior phone call.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS This application is a continuation of U.S. patent application Ser. No. 17/857,618, filed Jul. 5, 2022, which is a continuation of U.S. patent application Ser. No. 17/157,848, filed Jan. 25, 2021, which is a continuation U.S. patent application Ser. No. 16/378,286, filed Apr. 8, 2019, which is a continuation of U.S. patent application Ser. No. 15/600,625, filed May 19, 2017, which claims priority to U.S. Provisional Patent Application No. 62/370,135, filed Aug. 2, 2016, and claims priority to U.S. Provisional Patent Application No. 62/370,122, filed Aug. 2, 2016, each of which is incorporated by reference in its entirety. BACKGROUND Dual-tone multifrequency (DTMF) signaling conveys information over the telephone network. DTMF tones—commercially known as “touch-tones”—are often used to communicate a telephone number to a switch, but they are also becoming an important component in the growing use of Interactive Voice Response (IVR) systems. IVR systems are a common method for an initial interface with a user at a call center. Before (and if at all) a user is routed to an agent, the user may be prompted to enter some details that identify the user and the user's specific query. The entry is typically performed using the telephone keypad. There are sixteen different DTMF tones (defining digits 0-9, #, *, and A, B, C, D) defined using combinations of eight different single-frequency tones. As telecommunication devices and protocols progress and develop, the definition for generating DTMF tones also changes depending on the device type. So-called “plain old telephone service” (POTS) landline phones, Global System for Mobile Communications (GSM) cell phones, and Voice over Internet Protocol (VOIP) phones all handle DTMF differently. Furthermore, as DTMF tones traverse the public switched telephone network (PSTN) network, they will be modified slightly due to noise and other effects due to the communication channel. In most cases, these modifications are gentle enough not to affect the DTMF detection algorithms that map the audio signal to its corresponding value (e.g. 0-9, #, *, and A, B, C, D). As recognized by the inventors, the audio signal of DTMF tones generated by a far end user will exhibit deviations from an “ideal” DTMF tone when observed at the near end of a call. This discrepancy will depend on the type of device used and on the relative geographical locations of the near and far end users. The ideal DTMF tone is known a priori, and by calculating various statistical entities based on the difference between the ideal DTMF tone and the observed, the device type and the relative geographic location of a user can be provided. As recognized by the inventors, different makes and models of telephones, smartphones, and softphones often have uniquely identifiable DTMF tones. By monitoring the tones of a known device type, phone number, or user, future tones can be used to determine the device type or authenticity of the phone number or user. SUMMARY In general, one aspect of the subject matter described in this specification can be embodied in a computer-implemented method to classify a call, the computer-implemented method comprising: receiving dual-tone multifrequency (DTMF) information from a call; determining a feature vector based on the DTMF information; comparing the feature vector to a model; and classifying the call based on the comparison of the feature vector to the model. These and other embodiments can optionally include one or more of the following features. In at least one embodiment of the computer-implemented method to classify the call, the computer-implemented method to classify the call further comprises prompting, by an Interactive Voice Response (IVR) system, entry of the DTMF information. In at least one embodiment, the computer-implemented method to classify the call further comprises determining an ideal DTMF tone, wherein the determining the feature vector based on the DTMF information includes determining a feature based on the ideal DTMF tone. In at least one embodiment, the computer-implemented method to classify the call further comprises estimating channel noise in a DTMF tone, wherein the determining the feature vector based on the DTMF information includes determining a feature based on the channel noise. In at least one embodiment, the computer-implemented method to classify the call further comprises estimating additive noise in a DTMF tone, wherein the determining the feature vector based on the DTMF information includes determining a feature based on the additive noise. In at least one embodiment of the computer-implemented method to classify the call, the feature vector is a vector of features including at least one feature, and the at least one feature is based on at least one of a mean, a median, a variance, a standard deviation, a frequency, a wavelength, a duration, a coefficient of variation, or a percentile of DTMF information.