The high asymmetry of international termination rates, where calls are charged with higher values, are fertile ground for the appearance of frauds in Telecom Companies. In this paper, we present a solution for a real problem called Interconnect Bypass Fraud. This problem is one of the most expressive in the telecommunication domain and can be detected by the occurrence of burst of calls from speci c numbers. Based on this assumption, we propose the adoption of a new fast forgetting technique that works together with the Lossy Counting algorithm. Our goal is to detect as soon as possible items with abnormal behaviours, e.g. bursts of calls, repetitions and mirror behaviours. The results shows that our technique not only complements the techniques used by the telecom company but also improves the performance of the Lossy Counting algorithm in terms of runtime, memory used and sensibility to detect the abnormal behaviours.
Bypass Fraud, recent changes in regulation, namely in the European Union space, are creating a favourable context for this type of fraud to grow in more developed countries, as interconnect rates grown to compensate losses in revenues resultant from the Roaming Like at Home directive.
And if Digital Transformation in Communication Service Providers raise new concerns, it also brings opportunities to a more e ective fraud ght. As systems evolve towards more real-time and intelligent capabilities, it enables also real-time fraud controls to be implemented in a faster and cheaper way, as well as creating a space for new generation of adaptive Machine Learning based controls.
In this paper we will focus on a solution to e ciently detect Interconnect Bypass Fraud, in order to be used in real-time. This fraud explores the forward of international calls using low cost IP connections. Despite of the fact that Fraudsters are shaping usage patterns to avoid traditional fraud detection controls, Interconnect Bypass Fraud is often characterised by the occurrence of burst of calls.
Based on this assumption in this paper, we propose the adoption of fast forgetting technique together with the Lossy Counting algorithm. Our goal is to detect as soon as possible items with abnormal behaviours. This methodology, when compared with the pre-existing approaches referred in Section 3, enables to detect recent abnormal patterns like (bursts of calls, repetition and mirror behaviours).
The main contributions of this paper are summarised as follows: • We perform experiments on a real-world data set, demonstrating that the Fast Forgetting technique significantly increases the detection of abnormal behaviours. • We propose an extension of the Lossy Counting algorithm which includes the adoption of a new forgetting mechanism to fast detect abnormal behaviours. • We apply the Lossy Counting algorithm with Fast Forgetting for the rst time on the fraud detection domain.
In terms of organisation, this document contains six sections. Section 2 is dedicated to the problem de nition. Section 3 presents the state of the art on frequent itemsets using Lossy Counting. Section 4 describes our approach, including the Lossy Counting algorithm with the fast forgetting. Section 5 describes the experiments and discusses the results obtained. Finally, Section 6 draws the conclusions and suggests future developments. 2
The high asymmetry of international termination rates vis-a-vis domestic ones, where international calls are charged by the operator where the call terminates at a signi cantly higher value, are fertile ground for the appearance of fraud in Telecommunications. There are several types of fraud that exploit this type of di erential being the Interconnect Bypass Fraud one of the most expressive.
In this type of fraud, one of several intermediaries responsible for delivering the calls forwards the tra c over a low cost IP connection, reintroducing the call in the destination network already as a local call, using VOIP Gateways. In this way, it charges the entity that sent the tra c the amount corresponding to the delivery of international tra c, but once it has illegally delivered as national tra c, it will not have to pay the international termination fee, appropriating this amount.
In addition to the nancial aspect, this type of fraud causes image costs because both the originating subscriber of the call and the one who receives it, end up having a poor call quality.
This type of fraud is traditionally detected by analysing the call patterns of these Gateways that, once identi ed, have their SIM cards blocked. These gateways have evolved over time, resembling some of them, true SIM Farms, capable of manipulating identi ers, simulating standard call patterns similar to the ones of normal users and even being mounted on vehicles for making it di cult to detect them using location information.
Another important aspect for the deterrence of this type of fraud has to do with the speed of detection and blocking. If the time required for detection and blocking is not long enough for the payback to compensate for the cost and e ort of system setup, the fraudster has no great incentive to bypass this operator.
A new approach is therefore necessary which, on the one hand, allows for su cient adaptability to identify increasingly hidden fraud patterns and on the other hand allowing large-volume monitoring in real time so that, as soon as a suspicious behavior is detected an alert action is generated, or even immediate blocking, according to the degree of con dence of the particular detection.
It should be noted that this type of fraud, which was usually more prominent in developing countries where the cost of termination has always been high, has recently grown signi cantly in Europe as a result of the increase in termination charges for calls originating outside Europe, in order to compensate for the decrease of revenues resulting from the application of the roaming like at home directive in the European area. 3
The literature on data streams is abundant on approximate counting algorithms [Mut05]. Popular one-pass algorithms to approximate the most frequent items on an event stream are the SpaceSaving algorithm [MAEA05], the Frequent algorithm [CH10], the Sticky Sampling Algorithm [MM02], and the Lossy Counting algorithm [MM02]. The rst two, provide a rank of the most frequent items, while the last two algorithms provide approximate counts of the frequent items. In all cases, the algorithms are designed for processing high-speed data streams, using xed and restricted memory.
Sticky Sampling and Lossy Counting algorithms were presented in the [MM02] paper. They are based on the same idea of removing low-frequent items. While Lossy Counting is a deterministic algorithm, Sticky Sampling is a probabilistic one. Lossy counting is more accurate but Sticky Sampling requires constant space. Lossy Counting space requirements increase logarithmically with the length of the stream. Sticky sampling remembers every unique element that gets sampled, whereas Lossy Counting chops of low frequency elements quickly leaving only the high frequency ones. Sticky sampling can support in nite streams while keeping the same error guarantees as Lossy Counting.
Cormode et al. (2008) discuss hierarchical heavy hitters ( -HHH) in streaming data. Given a hierarchy and a support , nd all nodes in the hierarchy that have a total number of descendants in the data stream no smaller than N after discounting the descendant nodes that are also -HHH [CKMS08]. This is of particular interest for monitoring structured and networked data, like XML data, and explores the internal structure of data. Other Recent works for fast computing frequent items include [LJ11, NIY19, SN18]. 4
Manku and Motwani in [MM02] present the LossyCounting algorithm, a one-pass algorithm for computing frequency counts exceeding a user-speci ed threshold over data streams. Although the output is approximate, the error is guaranteed not to exceed a user-speci ed parameter. LossyCounting requires two user-speci ed parameters: a support threshold s 2 [0; 1], and an error parameter 2 [0; 1] such that s. At any point of time, the LossyCounting algorithm can produce a list of item(set)s along with their estimated frequencies. 4.1
The LossyCounting Algorithm Let N denote the current length of the stream. The answers produced will have the following guarantees: • All item(set)s whose true frequency exceeds s
N .
The incoming stream is conceptually divided into buckets of width w = N transactions each. Buckets are labelled with bucket ids, starting from 1. Denote the current bucket id by bcurrent. For an element e, denote its true frequency in the stream seen so far by fe. The frequent elements are stored in a data structure T . T contains a set of entries of the form (e; f; ), where e is the element, f its estimated frequency, and is the maximum possible error in f .
The pseudo-code of the Lossy Count algorithm, is presented in Algorithm 1 [Gam10]. It works as follows. Initially, T , is empty. Whenever a new element e arrives, if an entry for e already exists, the algorithm increments its counter f . Otherwise, a new entry is created of the form (e; 1; N ). At bucket boundaries, the set T is pruned. The rule for deletion is: an entry (e; f; ) is deleted if f + N . When a user requests a list of item with threshold s, LossyCounting outputs all the entries in T where f (s ) N . 4.2
Depending on the application, the Lossy Counting algorithm might treat a tuple as a single item or as a set of items. In the latter case, the input stream is not processed transaction by transaction. Instead, the available main memory is lled in with as many transactions as possible. After that, they process such a batch of transactions together. Let denote the number of buckets in memory. foreach all j 2 T do if Countj < then
T T nfjg end end end end end
As for items, Lossy Counting maintains a data structure T , as a set of entries of the form (set; f; ), where set is a subset of items, f is an integer representing its approximate frequency, and is the maximum possible error in f . D is updated as follows: • Update itemset: For each entry (set; f; ), update by counting the occurrences of set in the current batch.
Delete any entry such that f + bcurrent;
in the current batch and does not occur in T , create a new fset )
N has an entry in T . Moreover, for any entry (set; f; ) 2 D, the true
f + . When a user requests a list of items with threshold s, • New itemset: If a set set has frequency f
entry (set; f; bcurrent ).
frequency fset satis es the inequality f output those entries in T , where f (s 4.3
The Lossy Counting algorithm computes the frequency of items or sets of items in a stream of buckets. However, this algorithm do not capture small variations on each bucket because the continuous increment of the most frequent items of the stream. We propose the adoption of forgetting factors to reduce the relevance of old elements, and capture small frequency variations on the stream.
T contains a set of entries of the form (e; f; ), where e is the element, f its estimated frequency, and is the maximum possible error in f taking into account the accumulated forgetting values. is the accumulated forgetting factors applied on the buckets and can be described by w + , where w is the width of the bucket and is the forgetting factor.
The pseudo-code of Lossy Counting with fast forgetting is presented in Algorithm 2. It works as follows. Initially, T , is empty. Whenever a new element e arrives, if an entry for e already exists, the algorithm increments its counter f . Otherwise, a new entry is created of the form (e; 1; ). At bucket boundaries, the algorithm applies the forgetting factor to each element on the data structure T and the set T is pruned taking into account the accumulated forgetting factors. The rule for deletion is: an entry (e; f; ) is deleted if f + . When a user requests a list of item with threshold s, Lossy Counting with fast forgetting outputs all the entries in T where f (s ) . input: S: A Sequence of Examples; : Error margin; : fast forgetting parameter begin n 0; 0; T 0; foreach example e 2 S do n n + 1 if e is monitored then
Increment Counte else
T T [ fe; 1 + g end if n 6= then foreach all j 2 T do
Countj Countj if Countj < then
T T nfjg end end end end end 4.4
Algorithm 2: The Lossy Counting with Fast Forgetting Algorithm.
The results of Lossy Counting are order-dependent, giving heavier weight to the counts processed last. In our case, this makes perfect sense because we want to detect as soon as possible, items with a burst in activity. These burst are potential abnormal activities that must be analysed for fraud detection. The focus in recent items is very much improved with the new forgetting mechanism we introduce. 5
The following subsections present the data description, the experiments, the results obtained and a nal discussion. The experiments were performed with an Intel Core CPU i5-5200u 2:20 GHz Central Processing Unit (CPU), 4 GB DDR3 Random Access Memory (RAM) and 1 TB of hard drive. 5.1
Our proposal was evaluated with an anonymised phone calls data set, provided by a telecommunication company. The data set contains information about: (i) origin numbers (A-Numbers); (ii) destination number (B-Numbers); (iii) timestamp; and (iv) result, which represents if the call is blacklisted (code { 001) or not (code { 000). The data was collected during three months between 24/07/2018 to 21/10/2018 which includes 83 366 367 examples. 5.2
We made a set of experiments to verify the impact of applying forgetting on the Lossy Counting algorithm. The Lossy Counting algorithm proposed by Manku and Motwani (2002) it was our baseline algorithm. Figure 1 presents for each day the Top 5 A-Numbers that have a frequency higher than the pruning threshold. The algorithm capture a set of 12 A-Numbers or heavy hitters that can potential indicate some kind of fraud behaviour. However, using the Lossy Counting algorithm its di cult to discriminate repetition patterns or burst generated by the A-Numbers.
When we applied our fast forgetting mechanism the algorithm showed more sensibility to capture other ANumbers. Figure 2 shows a set of 35 heavy hitters and it is possible to verify variability on the Top 5 A-Numbers. With our technique we can rapidly observe on Figure 3: (i) burst of calls generated by the A-Numbers (ID 14); (ii) repetition pattern observed on A-Number (ID 1) which cannot be captured using the Lossy Count as we can observe on the Figure 1; and (iii) mirror patterns observed on A-Numbers (ID 8 and ID 22) and (ID 19 and ID 24).
The Interconnect Bypass Fraud is the most expressive fraud tactic in the telecommunication domain. The fraudsters explores the forwarding of international calls using low cost IP connections to increase their pro ts. This type of fraud is characterised by the occurrence of burst of calls.
We explore the use of a new fast forgetting mechanism for the Lossy Counting algorithm. This technique was designed to capture as soon as possible abnormal behaviours on phone calls.
= 0:99. The gure reports the top-5 most active A-Numbers
The contributions of this paper are at: (i) application level, to reduce the impact of Interconnect Bypass Fraud on the telecommunication companies; (ii) and at the methodology level, with the extension of the Lossy Counting algorithm with a fast forgetting mechanism to rapidly detect abnormal behaviours.
The experiments shows an inability of the Lossy Counting algorithm to detect recent items with abnormal behaviours (burst of calls, repetition and mirror behaviours). The results show that our proposal improved the detection of these recent items. Furthermore, our forgetting mechanism reduces the execution and memory used to compute the data stream, increasing the speedup of the algorithm.
For future research we explore the use of ranges to detect A-Numbers with similar behaviours. 6.0.1
Authors acknowledge the project ML-ABA - Machine Learn based Adaptive Business Assurance, Individual Demonstration Projects, NUP: FCOMP-01-0202-FEDER-038204, a project co-funded by the Incentive System for Research and Technological Development, from the Thematic Operational Program Competitiveness of the national framework program - Portugal2020. We also acknowledge the support of the project FailStopper (DSAIPA / DS /0086/2018).