Technical Support Scam Protection via CPE Traffic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Technical support scams exploit technically less experienced individuals by gaining remote access to their devices, leading to financial fraud through various means, with existing solutions failing to effectively prevent such scams.
Innovation Solution
A method involving data communication interception and analysis to detect simultaneous activity of remote access and online banking software, blocking these connections to prevent scammer access and manipulation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If remote access software is installed to resolve technical issues, then technical support is provided, but unauthorized access and financial fraud occur
Solution Approach 1:
The system performs preliminary detection by monitoring for the installation of remote access software and analyzing subsequent network traffic patterns. Before significant harm can occur, the system detects the suspicious combination of remote access software installation followed by online banking software activity, and blocks the connection. This preliminary action prevents the scammer from gaining full control to commit fraud.
Solution Approach 2:
The CPE acts as an intermediary device between the user apparatus and external networks. It intercepts and analyzes network traffic, detecting the suspicious pattern of remote access software followed by online banking software. The CPE then blocks malicious connections while allowing legitimate traffic to pass through, serving as a protective mediator that distinguishes between authorized and unauthorized access.
2Reliability
If network traffic is monitored to detect scams, then fraud prevention is improved, but system complexity increases
Solution Approach 1:
The fraud detection system is segmented into distinct functional modules: a detection module that identifies remote access software installation, an analysis module that monitors subsequent network traffic for online banking software activity, and a blocking module that prevents malicious connections. This segmentation allows each module to perform its specific function efficiently without requiring the entire system to be overly complex.
Solution Approach 2:
The system uses the user's own network infrastructure (CPE) to perform the monitoring and detection functions. Rather than requiring a separate centralized monitoring system, the CPE itself provides the fraud detection capability by analyzing its own intercepted traffic. This self-service approach reduces overall system complexity while maintaining high reliability.
Data Source
AI summary
Data communication of a user apparatus via a customer-premises equipment (CPE) is intercepted. The CPE implements a local area network for the data communication of the user apparatus. First network traffic related to a remote access software in the user apparatus is detected in the data communication. Second network traffic related to an online banking software in the user apparatus is detected in the data communication. The first network traffic and the second network traffic are determined to coincide. In response to determining that the first network traffic and the second network traffic coincide, the first network traffic related to the remote access software in the user apparatus is blocked via the CPE.