This is the scenario:

Client -> Server

The client sends multiple voice calls to Server. Call info:

  • calling number
  • called number
  • call duration
  • source IP
  • destination IP
  • SIP header information (User-Agent, Version, Proxy information)

Other patterns:

  • Numeric Patterns - Destination.

  • Time Patterns - Calls occurring too regularly, activity at unusual times or dates.

  • Geographic Patterns - Proximity relationships between apparently unrelated entities.

In case of Toll fraud and client being insecure, the attacker can send calls via original agent hence the Service Provider won't reject calls immediately at least based from IP information. (Toll fraud). I'm exploring which approach is the best to implement an ML model, instead of static rules to be able to detect Toll fraud in a live system:

  • Classification (Fraud or not)
  • Reinforcement Learning (If fraud then reward)

I'm new to RL, does this scenario makes sense for live systems? Can I use offline data to train an RL model? Offline data includes Fraud cases detected historically.


  • 2
    $\begingroup$ One remark: In this scenario, you might want to give a higher weight to either false negatives (failing to recognize a fraud) than to false positives (incorrectly marking a call as a fraud). $\endgroup$ – Elias Strehle Feb 7 '18 at 17:03

I think it makes sense to stick with Classification here, since you already have examples of fraudulent and non-fraudulent calls that you can train on.

It might also be beneficial to train several models for different regions based on IP, as well as your 'global' model, and apply the region specific and global models to incoming calls. Just a few ideas.

From what I understand, real-time learning would require immediate feedback, which most fraud detection systems can't provide. For example, it may take a few days or weeks to have a case of fraud resolved (labelled fraud/not-fraud), and therefore take some time for the learning system to receive the feedback on it's prediction.

  • $\begingroup$ Hi Dan, thanks for responding, I'm planning to use multiple Honeypots distributed geographically that collect attack information and share that information live. Would that help to build an RL model? $\endgroup$ – gogasca Feb 7 '18 at 17:43
  • $\begingroup$ Hey Spicy! I'm not sure I understand. Do you mean these honeypots can identify attacks themselves? If they can provide quick feedback on the actual classification of the attack/non-attack then it could possibly work. Is the purpose of your proposed RL model to intercept attacks before they reach the 'honey pots'? $\endgroup$ – Dan Carter Feb 8 '18 at 12:31
  • $\begingroup$ Hi Dan, yes these honeypots are IP PBX open to the internet, they are distributed worldwide and are launched randomly, hence IP address will be allocated randomly by AWS. Since there are many bots around scanning AWS, Azure, Gcloud, etc. The honeypots will be attacked and capture the attacker information. (Example: called number, source ip address, SIP headers). $\endgroup$ – gogasca Feb 8 '18 at 18:43
  • $\begingroup$ Since they will be identifying only attacks, I may need to add information for valid calls. $\endgroup$ – gogasca Feb 8 '18 at 18:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.