Abstract: Data stream based event sequence anomaly detection for mobility customer fraud analysis is presented herein. A system obtains a sequence of events comprising respective modalities of communication that correspond to a subscriber identity associated with a communication service—the sequence of events having occurred within a defined period. Based on defined classifiers representing respective fraudulent sequences of events, the system determines, via a group of machine learning models corresponding to respective machine learning processes, whether the sequence of events satisfies a defined condition with respect to likelihood of representing a fraudulent sequence of events of the respective fraudulent sequences of events. In response to the sequence of events being determined to satisfy the defined condition, the system sends, via a user interface of the system, a notification indicating that the sequence of events has been determined to represent the fraudulent sequence of events.

Abstract: A processing system may apply a community detection process to a feature graph database to identify a plurality of communities of features, the feature graph database comprising: a plurality of objects, each associated with one of a feature or a concept, and a plurality of relationships between the plurality of objects. Next, the processing system may label a first plurality of features of the feature graph database with at least a first community label, where the first plurality of features comprises features of at least a first community of the plurality of communities. The processing system may then obtain a search associated with at least one feature of the feature graph database, where the at least one feature is a part of the at least the first plurality of features of the at least the first community, and provide the first plurality of features in response to the search.

Abstract: A processing system may obtain a request to add at least a first feature to a feature graph database, where the request comprises a first feature ontology of the first feature, and where the first feature ontology comprises: a label of the first feature and a relationship of the first feature to a concept or to another feature. The processing system may then identify whether the first feature is a duplicate of a second feature in the feature graph database based at least upon the first feature ontology and a second feature ontology of the second feature and generate an indication of whether the first feature is a duplicate in response to the identifying.

Abstract: A processing system may maintain a communication graph that includes nodes representing a plurality of phone numbers including a first phone number and edges between the nodes representing a plurality of communications between the plurality of phone numbers and may generate at least one vector via a graph embedding process applied to the communication graph, the at least one vector representing features of at least a portion of the communication graph. The processing system may then apply the at least one vector to a prediction model that is implemented by the processing system and that is configured to predict whether the first phone number is associated with a type of network activity associated with a telecommunication network and may implement a remedial action in response to an output of the prediction model indicating that the first phone number is associated with the type of network activity.

Abstract: A processing system including at least one processor may obtain a personal identifier comprising a plurality of characters and generate a first embedding of the personal identifier in accordance with an embedding model. The processing system may then identify one or more embeddings of other personal identifiers that are within a threshold distance of the first embedding and generate an alert in response to the identifying of the one or more embeddings of the other personal identifiers that are within the threshold distance.

Abstract: A processing system may obtain a feature vector for a relationship between first and second user identities within a telecommunication network, the feature vector including: a first number of communications from the first user identity to the second user identity for a first communication channel, a first volume associated with the first number of communications, a second number of communications from the second user identity to the first user identity for the first communication channel, and a second volume associated with the second number of communications. The processing system may then calculate a scaled distance between the feature vector and a centroid comprising a mean vector of a set of relationships between user identities within the telecommunication network, where the scaled distance is associated to a trust value, and perform at least one remedial action in the telecommunication network based on the trust value.

Abstract: A method for detecting threat pathways using sequence graphs includes constructing a sequence graph from a set of data containing information about activities in a telecommunications service provider network, where the sequence graph represents a subset of the activities that occurs as a sequence, providing an embedding of the sequence graph as input to a machine learning model, wherein the machine learning model has been trained to detect when an input embedding of a sequence graph is likely to indicate a threat activity, determining, based on an output of the machine learning model, whether the subset of the activities is indicative of the threat activity, and initiating a remedial action to mitigate the threat activity.

Abstract: Mitigation of temporal generalization losses a target machine learning model is disclosed. Mitigation can be based on identifying, removing, modifying, transforming, etc., features, explanatory variables, models, etc., that can have an unstable relationship with a target outcome over time. Implementation of a more stable representation can be initiated. Temporal stability measures (TSMs) for one or more model feature(s) can be determined based on one or more variable performance metrics (VPMs). A group of one or more VPMs can be selected based on features of a model in either a development or production environment. Model feature modification can be recommended based on a TSM, which can prune a feature, transform a feature, add a feature, etc. Temporal stability information can be presented, e.g., via a dashboard-type user interface. Models can be updated based on mutations of a model comprising a feature modification(s), including competitive champion/challenger model updating.

Abstract: A processing system may obtain a customer identifier at a first retail location of a telecommunication network service provider, determine a recency factor of the identifier, obtain an identification of items of interest to the customer, and determine whether the customer has visited a second retail location of the provider within a time period prior to the customer being at the first retail location. The processing system may then apply, to a fraud detection machine learning model, a plurality of factors comprising: a quantity of items of interest, a value of the items, a factor associated with whether the customer has visited the second retail location within the time period, and the recency factor, where the fraud detection machine learning model outputs a fraud indicator value, determine that the fraud indicator value meets a warning threshold and present a warning to a device at the first retail location.

Abstract: A processing system may maintain a communication graph that includes nodes representing a plurality of phone numbers including a first phone number and edges between the nodes representing a plurality of communications between the plurality of phone numbers and may generate at least one vector via a graph embedding process applied to the communication graph, the at least one vector representing features of at least a portion of the communication graph. The processing system may then apply the at least one vector to a prediction model that is implemented by the processing system and that is configured to predict whether the first phone number is associated with a type of network activity associated with a telecommunication network and may implement a remedial action in response to an output of the prediction model indicating that the first phone number is associated with the type of network activity.

Abstract: A processing system may maintain a relationship graph that includes nodes and edges representing phone numbers and device identifiers having associations with the phone numbers. The processing system may obtain an identification of a first phone number or a first device identifier for a fraud evaluation and extract features from the relationship graph associated with at least one of the first phone number or the first device identifier. The plurality of features may include one or more device identifiers associated with the first phone number, or one or more phone numbers associated with the first device identifier. The processing system may then apply the features to a prediction model that is implemented by the processing system and that is configured to output a fraud risk value of the first phone number or the first device identifier and implement at least one remedial action in response to the fraud risk value.

Abstract: Aspects of the subject disclosure may include, for example, obtaining first information indicative of a first change to a first aspect of a user account; applying some or all of the first information to a first model to determine a first score associated with the first change; aggregating the first score with one or more first prior scores associated with one or more prior changes to the first aspect of the user account, resulting in a first aggregate score; obtaining second information indicative of a second change to a second aspect of the user account; applying some or all of the second information to a second model, that is different from the first model, to determine a second score associated with the second change; aggregating the second score with one or more second prior scores associated with one or more prior changes to the second aspect of the user account, resulting in a second aggregate score; and storing the first aggregate score and the second aggregate score in a database.

Abstract: An example method performed by a processing system obtaining a first port-in number for a first mobile device from a first mobile communications service provider, wherein the first port-in number is known to be involved in fraudulent activity, constructing a social graph of communications between the first port-in number and a plurality of other numbers associated with a plurality of other communications devices, identifying, by the processing system, a maximal subgraph of the social graph, wherein the maximal subgraph connects the first port-in number and a subset of the plurality of other numbers that includes those of the plurality of other numbers for which a usage metric is below a predefined threshold for a defined period of time prior to the first port-in number being ported into the first mobile communications service provider, and identifying, by the processing system, a potential fraud ring, based on the maximal subgraph.

Abstract: Aspects of the subject disclosure may include, for example, monitoring a first activity undertaken by a communication device during a first communication session, generating, based on the monitoring, first data that indicates an amount of time that is spent on the first activity, comparing, based on the generating, the first data to a threshold, and identifying, based on at least the comparing, an action to take when the amount of time that is spent on the first activity exceeds the threshold. Other embodiments are disclosed.

Abstract: To detect multiple suspicious patterns while at the same time keeping the number of model parameters low, a learned aggregation model is used to distinguish suspiciously similar applications from unrelated applications.

Abstract: A method for detecting threat pathways using sequence graphs includes constructing a sequence graph from a set of data containing information about activities in a telecommunications service provider network, where the sequence graph represents a subset of the activities that occurs as a sequence, providing an embedding of the sequence graph as input to a machine learning model, wherein the machine learning model has been trained to detect when an input embedding of a sequence graph is likely to indicate a threat activity, determining, based on an output of the machine learning model, whether the subset of the activities is indicative of the threat activity, and initiating a remedial action to mitigate the threat activity.

Abstract: Data stream based event sequence anomaly detection for mobility customer fraud analysis is presented herein. A system obtains a sequence of events comprising respective modalities of communication that correspond to a subscriber identity associated with a communication service—the sequence of events having occurred within a defined period. Based on defined classifiers representing respective fraudulent sequences of events, the system determines, via a group of machine learning models corresponding to respective machine learning processes, whether the sequence of events satisfies a defined condition with respect to likelihood of representing a fraudulent sequence of events of the respective fraudulent sequences of events. In response to the sequence of events being determined to satisfy the defined condition, the system sends, via a user interface of the system, a notification indicating that the sequence of events has been determined to represent the fraudulent sequence of events.

Abstract: An example method performed by a processing system obtaining a first port-in number for a first mobile device from a first mobile communications service provider, wherein the first port-in number is known to be involved in fraudulent activity, constructing a social graph of communications between the first port-in number and a plurality of other numbers associated with a plurality of other communications devices, identifying, by the processing system, a maximal subgraph of the social graph, wherein the maximal subgraph connects the first port-in number and a subset of the plurality of other numbers that includes those of the plurality of other numbers for which a usage metric is below a predefined threshold for a defined period of time prior to the first port-in number being ported into the first mobile communications service provider, and identifying, by the processing system, a potential fraud ring, based on the maximal subgraph.

Abstract: A processing system may determine a plurality of input features of a first machine learning model that is deployed in a telecommunication network for a prediction task associated with an operation of the telecommunication network and apply a time series forecast model to a historical data set of a first data source associated with at least one of the plurality of input features to generate a forecast upper bound of a first characteristic of the first data source for a first time period and a forecast lower bound of the first characteristic of the first data source for the first time period. The processing system may then detect that the first characteristic exceeds one of the forecast upper bound or the forecast lower bound during the first time period and generate an alert that an output of the first machine learning model may be faulty, in response to the detecting.

Abstract: An example method includes receiving data to be provided to an application using a scoring model for calculating a score, determining that the data is incompatible with a current feature set of the scoring model applied by the application, receiving a next best model of features in response to the determining that the data is incompatible with the current feature set, executing the application to calculate the score with the data and the features of the next best model, and generating an output in accordance with the score.