Mediating Function for Fraud Detection in Telecommunication Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current fraud detection mechanisms in telecommunication networks are inadequate in identifying sophisticated fraud attacks, as they operate independently and lack dynamic correlation between network security and fraud detection functions, leading to delayed and inefficient detection of serious fraud attempts.
Innovation Solution
A mediating function that monitors and correlates alerts from network security and fraud detection functions, modifying alert criteria based on received alerts to enhance the detection of network and terminal attacks, thereby improving the accuracy and speed of fraud detection by dynamically adjusting detection rules and thresholds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If network security function and fraud detection function operate independently with fixed alert criteria, then device complexity is reduced and ease of operation is improved, but detection precision and reliability deteriorate due to inability to detect sophisticated fraud attacks
Solution Approach 1:
An alert correlation function is introduced as an intermediary component that receives alerts from both the network security function and fraud detection function, analyzes their correlation, and generates coordinated fraud detection results. This mediator enables the two independent functions to work together effectively without requiring complex direct integration between them, thus improving detection precision while maintaining manageable system complexity.
Solution Approach 2:
The alert correlation function merges information from multiple independent detection functions (network security and fraud detection) into a unified analysis process. By combining alerts and analyzing their correlations, the system achieves more accurate fraud detection than any single function could accomplish alone, resolving the contradiction between detection precision and system complexity.
2Reliability
If alert criteria are dynamically modified based on received alerts, then detection reliability and precision improve, but device complexity and difficulty of operation increase
Solution Approach 1:
The alert correlation function dynamically modifies alert criteria based on incoming alerts from network security and fraud detection functions. This dynamic adaptation allows the system to improve detection reliability in response to emerging fraud patterns while the centralized control architecture manages the complexity of dynamic adjustments, preventing unmanageable system complexity.
Solution Approach 2:
The system implements feedback mechanisms where alerts from detection functions are analyzed and used to modify alert criteria for future detections. This feedback loop continuously improves detection reliability by learning from past alerts, while the automated nature of the feedback process prevents excessive operational complexity.
3Loss of information
If multiple detection functions analyze traffic and charging information separately, then ease of operation is maintained, but loss of information occurs due to lack of correlation between security alerts and fraud detection alerts
Solution Approach 1:
The alert correlation function serves multiple purposes: it receives and processes alerts from different detection functions, analyzes correlations between them, modifies alert criteria, and generates comprehensive fraud detection results. This multi-functional component prevents information loss by integrating data from various sources while maintaining operational simplicity through a single centralized analysis point.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
Method and arrangement in a mediating function (204) for supporting detection of fraud in a network, when a network security function (200) is employed for analysing activities in the network in view of predefined alert criteria, and a fraud detection function (202) is employed for analysing e.g. charging information of users. When a first alert is received from a first one of the network security function and the fraud detection function, indicating that the predefined alert criteria of said first function have been satisfied, the alert criteria of the second one of said network security function and fraud detection function are modified based on the received first alert. Thereby, the network security and fraud detection functions can be correlated and made more efficient regarding accuracy and/or speed in detecting fraud.