DESC:
FORM 2
THE PATENTS ACT, 1970
(39 of 1970)
&
THE PATENTS RULES, 2003

COMPLETE SPECIFICATION
(See section 10 and rule 13)
1. TITLE OF THE INVENTION
METHOD AND SYSTEM FOR DETECTION OF NON-HUMAN ENTITIES CALLING IN A NETWORK
2. APPLICANT(S)
NAME NATIONALITY ADDRESS
JIO PLATFORMS LIMITED INDIAN OFFICE-101, SAFFRON, NR. CENTRE POINT, PANCHWATI 5 RASTA, AMBAWADI, AHMEDABAD 380006, GUJARAT, INDIA
3.PREAMBLE TO THE DESCRIPTION

THE FOLLOWING SPECIFICATION PARTICULARLY DESCRIBES THE NATURE OF THIS INVENTION AND THE MANNER IN WHICH IT IS TO BE PERFORMED.

FIELD OF THE INVENTION
[0001] The present invention relates to the field of telecommunications and network management, more particularly relates to a method and system for detection of non-human entities calling in a network.
BACKGROUND OF THE INVENTION
[0002] A Telecommunications Service Provider (TSP) is a communications service provider that provides telephone and similar services. For example, local exchange carriers, mobile wireless communication companies, etc. With the exponential growth and demand in telecom, there are more service providers entering the market every day. A subscriber is free to choose a telecom service provider and with number portability coming into picture, it has become even easier and convenient for the subscriber to shift from one telecom service provider to another. Different service providers differ in terms of service quality, tariff, coverage, etc.
[0003] Interconnect is the process of handling calls for other service providers. This allows the customers of one service provider to communicate with the customers of another service provider. If two operators A and B are not interconnecting partners, then it would not be possible for a customer of Operator A to communicate with a customer of operator B. Usually, operators keep their agreements with each other to allow their customers to communicate with each other. This gives good business opportunity to all the operators engaged in interconnection. Any interconnection points at which the parties agree to connect their respective Networks is called "Interconnection Point".
[0004] Point of Interconnection (POI) in telecommunication is the physical interface between media gateways of two service providers, carriers, exchanges, enterprises. A trunk is a single channel of communication that allows multiple entities at one end to correspond with the correct entity at the other end. It is a “link” that carries many signals at the same time, creating more efficient network access between two nodes.
[0005] However, for all telecom service providers, a retail subscriber is bound by certain general conditions including the usage of services for personal use only, and commercial usage is not allowed generally. For commercial usage such as customer care calling services, toll free number, B2B calls, etc., the telecom service provider may have a different set of terms and conditions, charges, etc. A retail subscriber is therefore not allowed to use his number for commercial purposes such as call centre calling, dedicated customer service number and the like. It will be desired to identify such illegal usage and stop the same.
[0006] Besides, when a subscriber is using services, such as making call or sending messages within the network of his/her own telecom service provider, the terms and conditions and tariff etc. is easy to manage as it remains within the same network and no third party network is involved. However, in case of services when two or more different service providers are involved (inter-network), the revenue sharing becomes complex and depends upon the bi-lateral agreement between the service providers involved. IUC is the cost that a mobile operator pays to another operator for carrying through/ terminating a call. If a customer of Mobile Operator A calls a customer of Mobile Operator B and the call is completed, then A pays an IUC charge to B for carrying/facilitating the call.
[0007] Further, in the competitive telecom service provider market, the tariff plans of the service provider vary. It may happen so that the outgoing calls from a First Service Provider (FSP) may be cheaper than a Second Service Provider (SSP) or even free. The objective to provide cheaper and better services as compared to competition is generally to acquire new customers. In case of inter-network calls, the bilateral agreement between the service providers generally provides for revenue sharing, wherein the terminating network receives a part of the revenue. For example, if SSP is the terminating network, the FSP will pay interconnecting charges to the SSP.
[0008] It may happen so that some mischievous elements might try to take advantage of such arrangements and use machines, software such as dedicated bots to make calls to generate unfair revenues in favour of one of the service providers in a case of internetwork services. For example, the SSP may use bots to make short unfair calls from the FSP network to the SSP network just to generate revenues based upon the arrangement of the terminating network revenue sharing model.
[0009] Besides the illegal revenue loss to the telecom service provider, the bots make the network congested and overloaded affecting the experience and service quality for the actual users of the network. The bots choke the network, and the effect is more pronounced especially in the areas / cells from where these bots operate.
[0010] There is a need for a solution that overcomes the above challenges and unfair / illegal practices and provides a system and method for identifying such unfair practices and detecting the bots being used for making such illegal calls.
SUMMARY OF THE INVENTION
[0011] One or more embodiments of the present invention provides a method and a system for detection of non-human entities calling in a network.
[0012] In one aspect of the present invention, the method for detection of non-human entities calling in the network is disclosed. The method includes the step of determining one or more values of one or more parameters pertaining to a plurality of calls received from multiple users in the network. The method further includes the step of creating one or more clusters of the multiple users pertaining to the plurality of calls received. The method further includes the step detecting the one or more non-human entities among the created one or more clusters that perform automated calling in the network based on a predefined threshold pertaining to the one or more parameters.
[0013] In one embodiment, the one or more parameters of the plurality of calls includes at least one of, a call duration, number of calls, a call frequency, call-gaps and a call ratio.
[0014] In one embodiment, the one or more parameters of the plurality of calls are stored in at least one of, a database and a file system.
[0015] In one embodiment, the step of creating one or more clusters of the multiple users pertaining to the received plurality of calls, includes the step of dividing, the plurality of calls pertaining to the multiple users to create one or more clusters of the multiple users based on at least one of, the determined one or more values of the one or more parameters, network operator defined one or more values of the one or more parameters and historical data pertaining to the one or more values of the one or more parameters.
[0016] In an embodiment, the step of detecting the one or more non-human entities among the created one or more clusters that perform automated calling in the network based on a predefined threshold pertaining to the one or more parameters, includes the steps of comparing the one or more parameters of the plurality of calls of the multiple users from the created one or more clusters with the predefined threshold. Further in response to determining, a deviation in at least one of, the one or more parameters of at least one portion of the one or more clusters of the multiple users pertaining to the plurality of calls exceeding the predefined threshold. Further the method includes the step of filtering, the at least one portion of the one or more clusters. The method includes the step of retrieving historical data of the filtered at least one portion of the one or more clusters of the multiple users from at least one of, the database and the file system. The method further includes the step of detecting the non-human entities among the filtered at least one portion of the one or more clusters of the multiple users that perform automated calling in the network based on the retrieved historical data.
[0017] In an embodiment, the detected at least one portion of the one or more clusters among the filtered at least one portion of the one or more clusters of the multiple users that perform automated calling in the network includes at least one of, a bot.
[0018] In an embodiment, the predefined threshold is set based on based on at least one of, the network operator defined one or more values of the one or more parameters and the historical data pertaining to the one or more values of the one or more parameters.
[0019] In one embodiment, the steps of, creating the one or more clusters and detecting, the one or more non-human entities is performed by the one or more processors, utilizing a trained model, wherein the model is trained by the one or more processors, with at least one of, the determined one or more values of the one or more parameters, a network operator defined values for the one or more parameters and historical data pertaining to the one or more values of the one or more parameters.
[0020] In one embodiment, the trained model learns trends/patterns related to the one or more parameters of the calls.
[0021] In another aspect of the present invention, the system for detection of non-human entities calling in the network is disclosed. The system includes a determination unit configured to determine one or more values of one or more parameters pertaining to a plurality of calls received from multiple users in the network. The system further includes a creating unit configured to create one or more clusters of the multiple users pertaining to the plurality of calls received. The system further includes a detection unit, configured to, detect the one or more non-human entities among the created one or more clusters that perform automated calling in the network based on a predefined threshold pertaining to the one or more parameters.
[0022] In another aspect of the present invention, a User Equipment (UE) is disclosed. One or more primary processors of the UE is communicatively coupled to one or more processors. The one or more primary processors are coupled with a memory. The memory stores instructions which when executed by the one or more primary processors causes the UE to transmit the plurality of calls to the one or more processors.
[0023] In yet another aspect of the present invention, a non-transitory computer-readable medium having stored thereon computer-readable instructions that, when executed by a processor, causes the processor to determine one or more values of one or more parameters pertaining to a plurality of calls received from multiple users in the network. The processor is further configured to create, utilizing the trained model, one or more clusters of the multiple users pertaining to the received plurality of calls. The processor is further configured to detect, utilizing the trained model, one or more non-human entities among the created one or more clusters that perform automated calling in the network based on a predefined threshold pertaining to the one or more parameters.
[0024] The features and advantages described in this summary and in the following detailed description are not all-inclusive, and particularly, many additional features and advantages will be apparent to one of ordinary skill in the relevant art, in view of the drawings, specification, and claims hereof. Moreover, it should be noted that the language used in the specification has been principally selected for readability and instructional purposes and may not have been selected to delineate or circumscribe the inventive subject matter, resort to the claims being necessary to determine such inventive subject matter.

BRIEF DESCRIPTION OF THE DRAWINGS
[0025] The accompanying drawings, which are incorporated herein, and constitute a part of this disclosure, illustrate exemplary embodiments of the disclosed methods and systems in which like reference numerals refer to the same parts throughout the different drawings. Components in the drawings are not necessarily to scale, emphasis instead being placed upon clearly illustrating the principles of the present disclosure. Some drawings may indicate the components using block diagrams and may not represent the internal circuitry of each component. It will be appreciated by those skilled in the art that disclosure of such drawings includes disclosure of electrical components, electronic components or circuitry commonly used to implement such components.
[0026] FIG. 1 is an exemplary block diagram of a communication system for detection of non-human entities calling in a network, according to one or more embodiments of the present disclosure;
[0027] FIG. 2 is an exemplary block diagram of a system for detection of non-human entities calling in the network, according to one or more embodiments of the present disclosure;
[0028] FIG. 3 is a schematic representation of a workflow of the system of FIG. 2 communicably coupled with a User equipment (UE), according to one or more embodiments of the present disclosure
[0029] FIG. 4 is an exemplary diagram of an architecture of the system of the FIG. 2, according to one or more embodiments of the present disclosure;
[0030] FIG. 5 is a signal flow diagram for detection of non-human entities calling in the network, according to one or more embodiments of the present disclosure; and
[0031] FIG. 6 is a flow chart illustrating the method for detection of non-human entities calling in the network, according to one or more embodiments of the present disclosure.
[0032] The foregoing shall be more apparent from the following detailed description of the invention.

DETAILED DESCRIPTION OF THE INVENTION
[0033] Some embodiments of the present disclosure, illustrating all its features, will now be discussed in detail. It must also be noted that as used herein and in the appended claims, the singular forms "a", "an" and "the" include plural references unless the context clearly dictates otherwise.
[0034] Various modifications to the embodiment will be readily apparent to those skilled in the art and the generic principles herein may be applied to other embodiments. However, one of ordinary skill in the art will readily recognize that the present disclosure including the definitions listed here below are not intended to be limited to the embodiments illustrated but is to be accorded the widest scope consistent with the principles and features described herein.
[0035] A person of ordinary skill in the art will readily ascertain that the illustrated steps detailed in the figures and here below are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[0036] The present disclosure addresses the challenges faced in established technologies for detection of non-human entities calling in a network, where automated system or bots generated calls generate unfair revenues in favour of one of the service providers in a case of internetwork services. The solution provides system and method for identifying such unfair practices and detecting the bots being used for making such illegal calls.
[0037] Referring to FIG. 1, FIG. 1 illustrates an exemplary block diagram of a communication system 100 for detection of non-human entities calling in a network, according to one or more embodiments of the present disclosure. The communication system 100 includes a network 105, a User Equipment (UE) 110, a server 115, and a system 120. The UE 110 aids a user to interact with the system 120.
[0038] For the purpose of description and explanation, the description will be explained with respect to the UE 110, or to be more specific will be explained with respect to a first UE 110a, a second UE 110b, and a third UE 110c, and should nowhere be construed as limiting the scope of the present disclosure. Each of the first UE 110a, the second UE 110b, and the third UE 110c is configured to connect to the server 115 via the network 105. In alternate embodiments, the UE 110 may include a plurality of UEs as per the requirement. For ease of reference, each of the first UE 110a, the second UE 110b, and the third UE 110c, will hereinafter be collectively and individually referred to as the “User Equipment (UE) 110”.
[0039] In an embodiment, the UE 110 is one of, but not limited to, any electrical, electronic, electro-mechanical or an equipment and a combination of one or more of the above devices such as virtual reality (VR) devices, augmented reality (AR) devices, laptop, a general-purpose computer, desktop, personal digital assistant, tablet computer, mainframe computer, or any other computing device.
[0040] The network 105 may include, by way of example but not limitation, at least a portion of one or more networks having one or more nodes that transmit, receive, forward, generate, buffer, store, route, switch, process, or a combination thereof, etc. one or more messages, packets, signals, waves, voltage or current levels, some combination thereof, or so forth. The network 105 may also include, by way of example but not limitation, one or more of a wireless network, a wired network, an internet, an intranet, a public network, a private network, a packet-switched network, a circuit-switched network, an ad hoc network, an infrastructure network, a Public-Switched Telephone Network (PSTN), a cable network, a cellular network, a satellite network, a fiber optic network, a VOIP or some combination thereof.
[0041] The network 105 may include, but is not limited to, a Third Generation (3G), a Fourth Generation (4G), a Fifth Generation (5G), a Sixth Generation (6G), a New Radio (NR), a Narrow Band Internet of Things (NB-IoT), an Open Radio Access Network (O-RAN), and the like.
[0042] The communication system 100 includes the server 115 accessible via the network 105. The server 115 may include by way of example but not limitation, one or more of a standalone server, a server blade, a server rack, a bank of servers, a server farm, hardware supporting a part of a cloud service or system, a home server, hardware running a virtualized server, one or more processors executing code to function as a server, one or more machines performing server-side functionality as described herein, at least a portion of any of the above, some combination thereof. In an embodiment, the entity may include, but is not limited to, a vendor, a network operator, a company, an organization, a university, a lab facility, a business enterprise side, a defense facility side, or any other facility that provides service.
[0043] The communication system 100 further includes the system 120 communicably coupled to the server 115 and the UE 110 via the network 105. The system 120 is adapted to be embedded within the server 115 or is embedded as the individual entity. However, for the purpose of description, the system 120 is illustrated as remotely coupled with the server 115, without deviating from the scope of the present disclosure.
[0044] Operational and construction features of the system 120 will be explained in detail with respect to the following figures.
[0045] FIG. 2 illustrates an exemplary block diagram of the system 120 for detection of non-human entities calling in the network 105, according to one or more embodiments of the present disclosure.
[0046] As per the illustrated embodiment, the system 120 includes one or more processors 205, a memory 210, a user interface 215 and a database 220. For the purpose of description and explanation, the description will be explained with respect to one processor 205 and should nowhere be construed as limiting the scope of the present disclosure. In alternate embodiments, the system 120 may include more than one processor 205 as per the requirement of the network 105. The one or more processors 205, hereinafter referred to as the processor 205 may be implemented as one or more microprocessors, microcomputers, microcontrollers, digital signal processors, central processing units, state machines, logic circuitries, single board computers, and/or any devices that manipulate signals based on operational instructions.
[0047] As per the illustrated embodiment, the processor 205 is configured to fetch and execute computer-readable instructions stored in the memory 210. The memory 210 may be configured to store one or more computer-readable instructions or routines in a non-transitory computer-readable storage medium. The memory 210 may include any non-transitory storage device including, for example, volatile memory such as RAM, or non-volatile memory such as disk memory, EPROMs, FLASH memory, unalterable memory, and the like.
[0048] In an embodiment, the user interface 215 includes a variety of interfaces, for example, interfaces for data input and output devices, referred to as Input/Output (I/O) devices, storage devices, and the like. The user interface 215 facilitates communication of the system 120. In one embodiment, the user interface 215 provides a communication pathway for one or more components of the system 120.
[0049] In an embodiment, the database 220 is one of, but not limited to, a Elasticsearch database, a centralized database, a cloud-based database, a commercial database, an open-source database, a distributed database, an end-user database, a graphical database, a No-Structured Query Language (NoSQL) database, an object-oriented database, a personal database, an in-memory database, a document-based database, a time series database, a wide column database, a key value database, a search database, a cache databases, and so forth. The foregoing examples of database 220 types are non-limiting and may not be mutually exclusive e.g., the database can be both commercial and cloud-based, or both relational and open-source, etc.
[0050] In order for the system 120 to detect the non-human entities calling in the network 105, the processor 205 includes one or more modules. In one embodiment, the one or more modules includes, but not limited to, a determination unit 225, a training unit 230, a creating unit 235, a detection unit 240 communicably coupled to each other.
[0051] The determination unit 225, the training unit 230, the creating unit 235, the detection unit 240 in an embodiment, may be implemented as a combination of hardware and programming (for example, programmable instructions) to implement one or more functionalities of the processor 205. In the examples described herein, such combinations of hardware and programming may be implemented in several different ways. For example, the programming for the processor 205 may be processor-executable instructions stored on a non-transitory machine-readable storage medium and the hardware for processor 205 may comprise a processing resource (for example, one or more processors), to execute such instructions. In the present examples, the memory 210 may store instructions that, when executed by the processing resource, implement the processor 205. In such examples, the system 120 may comprise the memory 210 storing the instructions and the processing resource to execute the instructions, or the memory 210 may be separate but accessible to the system 120 and the processing resource. In other examples, the processor 205 may be implemented by electronic circuitry.
[0052] In an embodiment, the determination unit 225 is configured to determine one or more values of one or more parameters pertaining to a plurality of calls received from multiple users in the network 105. The one or more parameter pertaining to the plurality of calls received from multiple users in the network includes, but not limited to, number of calls, call duration, call frequency, call-gaps and a call ratio. The call duration refers to the duration of each call, for example, 100 calls have an average duration of 3 minutes (herein the one or more values may refer to 100 calls, and 3 minutes of average call duration). The number of calls refers to the total number of calls made by the user, for example, the user made 200 calls in a single day. The call frequency is the rate at which calls are made over a specified period, for example, the user makes a call every 2 minutes consistently for 3 hours. The call gaps are the time interval between consecutive calls, for example, the user has call gaps of only 3-5 seconds between each call for a series of 60 calls. The call ratio is the ratio of certain types of calls to the total number of calls, for example, the user has a call ratio where 80% of their calls are less than 20 seconds long, compared to the network average where only 10% of calls are that short.
[0053] The one or more parameters of the plurality of calls are stored in the at least one of the database 220 and a file system. The file system is a method and data structure that the system 120 uses to control how data is stored and retrieved on a storage device, such as a hard drive, Solid-State Drive (SSD), or other storage media. The plurality of calls refers to numerous calls received from the user. The user is at least one of mobile subscribers, telephone subscribers, network operator etc.
[0054] Upon determining the one or more values of the one or more parameters pertaining to the plurality of calls received from the multiple users in the network 105, the creating unit 235 is configured to create one or more clusters of the multiple users pertaining to the plurality of calls received. The one or more clusters refers to the group of users whose call behavior is similar according to predefined parameters such as call duration, the number of calls, call frequency, call-gaps, and call ratio.
[0055] The creating unit 235 creates the one or more clusters of the multiple users pertaining to the received plurality of calls by dividing the plurality of calls pertaining to the multiple users to create one or more clusters of the multiple users. For example, herein, let the one or more clusters include two clusters cluster 1 and cluster 2, the cluster 1 can include information pertaining to the users frequent short calls and the cluster 2 can include the information pertaining to the user’s irregular call patterns with long durations.
[0056] In an embodiment, the creating unit 235 divides the plurality of calls pertaining to the multiple users to create one or more clusters of the multiple users based on at least one of, the determined one or more values of the one or more parameters, the network operator defined one or more values of the one or more parameters and historical data pertaining to the one or more values of the one or more parameters. The determined one or more values of the one or more parameters refers to the values derived from the analysis of the current call data received from the users. For example, if users are making calls with similar durations and frequencies, those users might be grouped together. The network operator defined one or more values of the one or more parameters refers to the predefined thresholds or values established by the network operator based on their understanding of normal user behavior. For example, the network operator might define that users typically make 10-20 calls per day, each lasting around 2-5 minutes. The historical data pertaining to the one or more values of the one or more parameters refers to data collected over time that shows trends and patterns in calling behavior. For example, over the past year, the average call frequency for similar users was consistently around 15 calls/day with an average duration of 3 minutes.
[0057] In an embodiment, the creating unit 235 is configured to create the one or more cluster utilizing a trained model. The trained model is at least one of Artificial Intelligence/ Machine Learning (AI/ML) model. The AI/ML model is at least one of supervised learning models, unsupervised learning models, semi-supervised learning models, reinforcement learning models, deep learning models, ensemble learning models. The AI/ML models include, but are not limited to, linear regression, logistic regression, decision tress, K-Means clustering, hierarchical clustering, label propagation, Q-learning, Deep Q-Networks (DQN), Convolutional Neural Networks (CNNs) etc.
[0058] The training unit 230 is configured to train the model with at least one of the determined one or more values of the one or more parameters, a network operator defined values for the one or more parameters and historical data pertaining to the one or more values of the one or more parameters. The trained model learns trends/ patterns related to the one or more parameters of the calls. The trend refers to how the user behavior evolves over time. For example, the trend might be observed where a particular user or group of users gradually increases their call frequency over weeks or months. For instance, a user who has previously made 10 calls per day may start making 50 calls per day over the next few weeks, indicating possible automated behavior. The patterns are specific, recurring behaviors or characteristics within the data that can be identified through analysis. For example, the pattern may show that the users typically have calls lasting between 2 to 5 minutes.
[0059] Upon creating the one or more clusters of the multiple users pertaining to the plurality of calls received, the detection unit 240 is configured to detect the one or more non-human entities among the created one or more clusters that perform automated calling in the network 105. The one or more non-human entities among the created one or more clusters that perform automated calling in the network 105 is detected based on a predefined threshold pertaining to the one or more parameters. In an embodiment, the detection unit 240 is configured to detect the one or more non-human entities utilizing the trained model.
[0060] The one or more non-human entities refers to automated systems or programs that make calls in a network without human intervention. The one or more non-human entities includes, but are not limited to, automated calling systems such as robots/ bots, predictive dialers, telemarketing systems etc. In an embodiment, the predefined threshold is set by the detection unit 240 based on at least one of, the network operator defined one or more values of the one or more parameters and the historical data pertaining to the one or more values of the one or more parameters. The predefined threshold is a boundary or criterion that defines what is considered normal or acceptable behavior in terms of calling patterns. The predefined threshold based on the network operator defined one or more values of the one or more parameters is the values set by the network operator based on industry standards, expected user behavior, and operational norms. For example, the network operator defines the call frequency of the normal users making calls between 10 to 20 calls per day. If the user makes a calls more than 20 calls per day, then the predefine threshold value set by the network operator is crossed. The predefined threshold based on the historical data pertaining to the one or more values of the one or more parameters includes past data collected from users over time, which helps to identify patterns and trends in calling behaviors. For example, if the historical data shows that most users in a similar demographic make around 15 calls/day, that data supports the defined threshold of 10-20 calls.
[0061] The detection unit 240 detects, the one or more non-human entities among the created one or more clusters that perform automated calling in the network based on the predefined threshold pertaining to the one or more parameters, by comparing the one or more parameters of the plurality of calls of the multiple users from the created one or more clusters with the predefined threshold. Upon comparing, the detection unit 240 determines the deviation in at least one of, the one or more parameters of at least one portion of the one or more clusters of the multiple users pertaining to the plurality of calls exceeding the predefined threshold. In response to determining, the detection unit 240 filters, the at least one portion of the one or more clusters. Further, the detection unit 240 retrieves the historical data of the filtered at least one portion of the one or more clusters from at least one of the database 220 and the file system 410 (as shown in FIG. 4). Based on the retrieved historical data, the detection unit 240 detects the non-human entities among the filtered at least one portion of the one or more clusters of the multiple users that perform automated calling in the network 105. The detected at least one portion of the one or more clusters among the filtered at least one portion of the one or more clusters of the multiple users that perform automated calling in the network includes at least one of, a bot. Therefore, the system 120 identifies unfair usage by identifying automated systems and/or bots and plugging the irrelevant leakage in the network 105.
[0062] FIG. 3 is a schematic representation of a workflow of the system of FIG. 2 communicably coupled with the User equipment (UE) 110, according to one or more embodiments of the present disclosure. It is to be noted that the embodiment with respect to FIG. 3 will be explained with respect to the first UE 110a and the system 120 for the purpose of description and illustration and should nowhere be construed as limited to the scope of the present disclosure.
[0063] As mentioned earlier in FIG. 1, the first UE 110a may include an external storage device, a bus, a main memory, a read-only memory, a mass storage device, communication port(s), and a processor. The exemplary embodiment as illustrated in FIG. 3 will be explained with respect to the first UE 110a without deviating from the scope of the present disclosure and limiting the scope of the present disclosure.
[0064] The first UE 110a includes one or more primary processors 305 communicably coupled to the one or more processors 205 of the system 120.The one or more primary processors 305 are coupled with a memory 310 storing instructions which are executed by the one or more primary processors 305. Execution of the stored instructions by the one or more primary processors 305 enables the first UE 110a to transmit, the plurality of calls to the one or more processors 205.
[0065] As mentioned earlier in FIG. 2, the one or more processors 202 of the system 120 is configured to detect non-human entities calling in the network 105. As per the illustrated embodiment, the system 120 includes the one or more processors 205, the memory 210, the user interface 215, and the database 220. The operations and functions of the one or more processors 205, the memory 210, the user interface 215, and the database 220 are already explained in FIG. 2. For the sake of brevity, a similar description related to the working and operation of the system 120 as illustrated in FIG. 2 has been omitted to avoid repetition.
[0066] Further, the processor 205 includes the determination unit 225, the training unit 230, the creating unit 235, the detection unit 240. The operations and functions of the determination unit 225, the training unit 230, the creating unit 235, the detection unit 240 are already explained in FIG. 2. Hence, for the sake of brevity, a similar description related to the working and operation of the system 120 as illustrated in FIG. 2 has been omitted to avoid repetition. The limited description provided for the system 120 in FIG. 3, should be read with the description as provided for the system 120 in the FIG. 2 above, and should not be construed as limiting the scope of the present disclosure.
[0067] FIG. 4 is an exemplary architecture 400 which can be implemented in the system 120 of the FIG.2) for detection of non-human entities calling in the network 105, according to one or more embodiments of the present invention.
[0068] The architecture 400 includes an ingestion layer 405, the database 220, the file system 410, a compute layer 415, the AI/ML model 420, a policy box 425, a rule engine 430, and a report generation engine 435.
[0069] The ingestion layer 405 collects Call Detail Record (CDR) of multiple users from the network 105. The CDR is a data record produced by a telephone exchange or other telecommunications equipment that documents the details of a telephone call or other telecommunications transaction (e.g., text message) that passes through the UE 110 of multiple users. The CDR includes at least one of parameters, but not limited to, call duration, number of calls, call frequency, call gaps, and call ratios of multiple users.
[0070] Upon receiving the CDR of multiple users from the network 105, the ingestion layer 405 transmits the collected CDR of multiple users to the database 220. The database 220 stores the CDR of multiple users, transmitted by the ingestion layer 405 for a certain period, for example consider the database 220 stores the CDR of multiple users, from three days to a week old. Thereafter the CDR of multiple users from the database 220 is transmitted to the file system 410. The CDR of multiple users stored in the file system 410 is accessible for processing and historical reference.
[0071] Upon storing the CDR of multiple users in the file system 410, the compute layer 415 creates the one or more clusters by utilizing the AI/ML model 420 and the CDR of multiple users stored in the file system 410. The AI/ML model 420 is trained with at least one of, historical data, network operator-defined values, and the determined parameter values to identify trends and patterns of CDR of multiple users.
[0072] In an embodiment, the policy box 425 and the rule engine 430 are configured to receive inputs from the AI/ML model 420 and from the user. The user is at least one of, but not limited to, network operator and network administrator.
[0073] In particular, the AI/ML model 420 transmits the CDR of multiple users to the policy box 425 and rule engine 430. The policy box 425 holds the policies and predefined thresholds for detecting non-human entities. Upon receiving the CDR of multiple users, the policy box 425 transmits the policies and predefined thresholds for detecting non-human entities to the rule engine 430. The rule engine 430 transmits the policies and predefined thresholds for detecting non-human entities to the AI/ML model 420. The AI/ML model transmits the policies and predefined thresholds for detecting non-human entities to the compute layer 415.
[0074] Upon receiving the policies and predefined thresholds for detecting non-human entities from the AI/ML model 420, the compute layer 415 compares the created one or more cluster of the multiple users with the policies and predefined thresholds. Upon comparing the created one or more cluster of the multiple users with the policies and predefined thresholds, the at least one portion of the one or more clusters of the multiple users exceeding the predefined thresholds are determined. In response to determining, the compute layer 415, transmits the at least one portion of the one or more clusters of the multiple users exceeding the predefined thresholds to the rule engine 430 for filtering the determined at least one portion of the one or more cluster via the AI/ML model 420.
[0075] The rule engine 430 transmits the filtered at least one portion of the one or more cluster to the compute layer 415 via the AI/ML model 420. Upon receiving the filtered at least one portion of the one or more cluster, the compute layer 415 retrieves the historical data of the filtered at least one portion of the one or more clusters of the multiple users from the file system 410. Thereafter, the compute layer 415 detects the non-human entities among the filtered at least one portion of the one or more clusters of the multiple users that perform automated calling in the network 105.
[0076] Subsequently, the compute layer 415 transmits the detected non-human entities among the filtered at least one portion of the one or more clusters of the multiple users to the report generation engine 435. The report generation engine 435 produces a report of the detected non-human entities that perform automated calling in the network 105.
[0077] FIG. 5 is a signal flow diagram for detection of non-human entities calling in the network 105, according to one or more embodiments of the present invention. For the purpose of description, the signal flow diagram is described with the embodiments as illustrated in FIG. 2 and FIG. 4 and should nowhere be construed as limiting the scope of the present disclosure.
[0078] At step 505, the ingestion layer collects the CDR of the multiple users from the network 105. The CDR includes at least one of parameters, but not limited to, call duration, number of calls, call frequency, call gaps, and call ratios of multiple users.
[0079] At step 510, the collected the CDR of the multiple users are transmitted to the at least one of, the database 220 and the file system 410.
[0080] At step 515, the compute layer 415 creates the one or more clusters by utilizing the AI/ML model 420 and the CDR of multiple users stored in the file system 410. The AI/ML model 420 is trained with at least one of, historical data, network operator-defined values, and the determined parameter values to identify trends and patterns of CDR of multiple users.
[0081] At step 520, the compute layer 415 detects the one or more non-human entities among the created one or more cluster that perform automated calling in the network 105 based on the predefined threshold pertaining to the CDR of the multiple users. The predefined threshold pertaining to the CDR of the multiple users is obtained from the AI/ML model 420 via the policy box 425 and the rule engine 430.
[0082] At step 525, the compute layer 415 compares the CDR of the multiple users with the predefined threshold pertaining to the CDR of the multiple users.
[0083] At step 530, upon comparing, the compute layer 415 determines the at least one portion of the one or more clusters of the multiple users exceeding the predefined thresholds. In response to determining, the at least one portion of the one or more clusters of the multiple users exceeding the predefined thresholds is filtered with the help of the rule engine 430 via the AI/ML model 420.
[0084] At step 535, upon receiving the filtered at least one portion of the one or more clusters of the multiple users, the compute layer 415 retrieves the historical data of the filtered at least one portion of the one or more clusters of the multiple users from at least one of, the database 220 and the file system 410. Based on retrieved historical data, the compute layer 415 detects the non-human entities among the filtered at least one portion of the one or more clusters of the multiple users that perform automated calling in the network 105.
[0085] At step 540, subsequently the compute layer 415 transmits the detected non-human entities that perform automated calling in the network 105 to the report generation engine to generate the report. The report includes the detected non-human entities that perform automated calling in the network 105.
[0086] FIG. 6 is a flow diagram illustrating a method for detection of non-human entities calling in the network 105, according to one or more embodiments of the present disclosure. For the purpose of description, the signal flow diagram is described with the embodiments as illustrated in FIG. 2 and should nowhere be construed as limiting the scope of the present disclosure.
[0087] At step 605, the method 600 includes the step of determining one or more values of one or more parameters pertaining to the plurality of calls received from the multiple users in the network 105 by the determination unit 225. The one or more parameters pertaining to the plurality of calls received includes at least one of, but not limited to, call duration, number of calls, a call frequency, call-gaps and a call ratio. The one or more parameters of the plurality of calls are stored in at least one of, the database 220 and the file system 410.
[0088] At step 610, the method 600 includes the step of creating the one or more clusters of the multiple users pertaining to the plurality of calls received by the creating unit 235. Further, the creating unit 235 creates the one or more clusters of the multiple users pertaining to the received plurality of calls by dividing the plurality of calls pertaining to the multiple users to create one or more clusters of the multiple users based on the at least one of, the determined one or more values of the one or more parameters, the network operator defined one or more values of the one or more parameters and the historical data pertaining to the one or more values of the one or more parameters.
[0089] In an embodiment, the one or more clusters are created by utilizing the trained model. The trained model is trained by the training unit 230 with at least one of, the determined one or more values of the one or more parameters, the network operator defined values for the one or more parameters and the historical data pertaining to the one or more values of the one or more parameters. The trained model learns trends/patterns related to the one or more parameters of the calls.
[0090] At step 615, the method 600 includes the step of detecting utilizing the trained model, the one or more non-human entities among the created one or more clusters that perform automated calling in the network based on the predefined threshold pertaining to the one or more parameters by the detection unit 240.
[0091] The detection unit 240 detects the one or more non-human entities among the created one or more clusters that perform automated calling in the network based on a predefined threshold pertaining to the one or more parameters by comparing the one or more parameters of the plurality of calls of the multiple users from the created one or more clusters with the predefined threshold. Further the detection unit 240 determines the deviation in at least one of, the one or more parameters of at least one portion of the one or more clusters of the multiple users pertaining to the plurality of calls exceeding the predefined threshold. In response to determining the detection unit 240 filters, the at least one portion of the one or more clusters. Further detection unit 240 retrieves the historical data of the filtered at least one portion of the one or more clusters from at least one of, the database 220 and the file system 410. Based on the retrieved historical data, the detection unit 240 detects the non-human entities among the filtered at least one portion of the one or more clusters of the multiple users that perform automated calling in the network 105.
[0092] The present invention further discloses a non-transitory computer-readable medium having stored thereon computer-readable instructions. The computer-readable instructions are executed by the processor 205. The processor 205 is configured to determine one or more values of one or more parameters pertaining to the plurality of calls received from multiple users in the network 105. The processor 205 is further configured to create, one or more clusters of the multiple users pertaining to the received plurality of calls. The processor 205 is further configured to detect, one or more non-human entities among the created one or more clusters that perform automated calling in the network 105 based on a predefined threshold pertaining to the one or more parameters.
[0093] A person of ordinary skill in the art will readily ascertain that the illustrated embodiments and steps in description and drawings (FIG.1-6) are set out to explain the exemplary embodiments shown, and it should be anticipated that ongoing technological development will change the manner in which particular functions are performed. These examples are presented herein for purposes of illustration, and not limitation. Further, the boundaries of the functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternative boundaries can be defined so long as the specified functions and relationships thereof are appropriately performed. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the disclosed embodiments.
[0094] The present disclosure incorporates technical advancement of identifying the automated system or bots generated calls. Further, the present invention facilitates the illegal revenue loss to the telecom service providers. Furthermore, the present invention identifies unfair usage by identifying automated systems and/or bots and plugging the irrelevant leakage in the network.
[0095] The present invention offers multiple advantages over the prior art and the above listed are a few examples to emphasize on some of the advantageous features. The listed advantages are to be read in a non-limiting manner.

REFERENCE NUMERALS
[0096] Communication system – 100
[0097] Network – 105
[0098] User Equipment – 110
[0099] Server – 115
[00100] System – 120
[00101] Processor -205
[00102] Memory – 210
[00103] User Interface– 215
[00104] Database- 220
[00105] Determination unit - 225
[00106] Training unit - 230
[00107] Creating unit - 235
[00108] Detection unit – 240
[00109] Selection unit – 245
[00110] Depiction unit - 250
[00111] Ingestion layer - 405
[00112] File system - 410
[00113] Compute layer - 415
[00114] AI/ML Model – 420
[00115] Policy box – 425
[00116] Rule engine – 430
[00117] Report generation engine - 435
,CLAIMS:CLAIMS
We Claim
1. A method (600) for detection of non-human entities calling in a network (105), the method (600) comprising the steps of:
determining, by one or more processors (205), one or more values of one or more parameters pertaining to a plurality of calls received from multiple users in the network (105);
creating, by the one or more processors (205), one or more clusters of the multiple users pertaining to the plurality of calls received; and
detecting, by the one or more processors (205), the one or more non-human entities among the created one or more clusters that perform automated calling in the network based on a predefined threshold pertaining to the one or more parameters.

2. The method (600) as claimed in claim 1, wherein the one or more parameters of the plurality of calls includes at least one of, a call duration, number of calls, a call frequency, call-gaps and a call ratio.

3. The method (600) as claimed in claim 1, wherein the one or more parameters of the plurality of calls are stored in at least one of, a database (220) and a file system (410).

4. The method (600) as claimed in claim 1, wherein the step of creating, one or more clusters of the multiple users pertaining to the received plurality of calls, includes the step of:
dividing, by the one or more processors (205), the plurality of calls pertaining to the multiple users to create one or more clusters of the multiple users based on at least one of, the determined one or more values of the one or more parameters, network operator defined one or more values of the one or more parameters and historical data pertaining to the one or more values of the one or more parameters.

5. The method (600) as claimed in claim 1, wherein the step of detecting, the one or more non-human entities among the created one or more clusters that perform automated calling in the network based on a predefined threshold pertaining to the one or more parameters, includes the steps of:
comparing, by the one or more processors (205), the one or more parameters of the plurality of calls of the multiple users from the created one or more clusters with the predefined threshold; and
in response to determining, by the one or more processors (205), a deviation in at least one of, the one or more parameters of at least one portion of the one or more clusters of the multiple users pertaining to the plurality of calls exceeding the predefined threshold, filtering, by the one or more processors, at least one portion of the one or more clusters;
retrieving, by the one or more processors (205), historical data of the filtered at least one portion of the one or more clusters of the multiple users from at least one of, the database and the file system; and
detecting, by the one or more processors (205), the non-human entities among the filtered at least one portion of the one or more clusters of the multiple users that perform automated calling in the network (105) based on the retrieved historical data.

6. The method (600) as claimed in claim 1, wherein the detected at least one portion of the one or more clusters among the filtered at least one portion of the one or more clusters of the multiple users that perform automated calling in the network includes at least one of, a bot.

7. The method (600) as claimed in claim 1, wherein the predefined threshold is set by the one or more processors, based on at least one of, the network operator defined one or more values of the one or more parameters and the historical data pertaining to the one or more values of the one or more parameters.

8. The method (600) as claimed in claim 1, wherein the steps of, creating the one or more clusters and detecting, the one or more non-human entities is performed by the one or more processors (205), utilizing a trained model, wherein the model is trained by the one or more processors, with at least one of, the determined one or more values of the one or more parameters, a network operator defined values for the one or more parameters and historical data pertaining to the one or more values of the one or more parameters.

9. The method (600) as claimed in claim 9, wherein the trained model learns trends/patterns related to the one or more parameters of the calls.

10. A system (120) for detection of non-human entities calling in a network (105), the system (120) comprising:
a determination unit (225), configured to, determine, one or more values of one or more parameters pertaining to a plurality of calls received from multiple users in the network (105);
a creating unit (235), configured to, create, one or more clusters of the multiple users pertaining to the plurality of calls received; and
a detection unit (240), configured to, detect, the one or more non-human entities among the created one or more clusters that perform automated calling in the network based on a predefined threshold pertaining to the one or more parameters.

11. The system (120) as claimed in claim 11, wherein the one or more parameters of the plurality of calls includes at least one of, a call duration, number of calls, a call frequency, call-gaps and a call ratio.

12. The system (120) as claimed in claim 11, wherein the one or more parameters of the plurality of calls are stored in at least one of, a database (220) and a file system (410).

13. The system (120) as claimed in claim 11, wherein the creating unit (235) creates, one or more clusters of the multiple users pertaining to the received plurality of calls, by:
dividing, the plurality of calls pertaining to the multiple users to create one or more clusters of the multiple users based on at least one of, the determined one or more values of the one or more parameters, network operator defined one or more values of the one or more parameters and historical data pertaining to the one or more values of the one or more parameters.

14. The system (120) as claimed in claim 11, wherein the detection unit (240) detects, the one or more non-human entities among the created one or more clusters that perform automated calling in the network based on a predefined threshold pertaining to the one or more parameters, by:
comparing, the one or more parameters of the plurality of calls of the multiple users from the created one or more clusters with the predefined threshold; and
in response to determining, a deviation in at least one of, the one or more parameters of at least one portion of the one or more clusters of the multiple users pertaining to the plurality of calls exceeding the predefined threshold, filtering, the at least one portion of the one or more clusters;
retrieving, historical data of the filtered at least one portion of the one or more clusters of the multiple users from at least one of, the database and the file system; and
detecting, the non-human entities among the filtered at least one portion of the one or more clusters of the multiple users that perform automated calling in the network (105) based on the retrieved historical data.

15. The system (120) as claimed in claim 11, wherein the detected at least one portion of the one or more clusters among the filtered at least one portion of the one or more clusters of the multiple users that perform automated calling in the network includes at least one of, a bot.

16. The system (120) as claimed in claim 11, wherein the predefined threshold is set by the detection unit, based on at least one of, the network operator defined one or more values of the one or more parameters and the historical data pertaining to the one or more values of the one or more parameters.

17. The system (120) as claimed in claim 11, wherein the creating unit is configured to, create the one or more clusters utilizing a trained model, and the detection unit is configured to, detect, the one or more non-human entities utilizing the trained model, wherein a training unit trains the model with at least one of, the determined one or more values of the one or more parameters, a network operator defined values for the one or more parameters and historical data pertaining to the one or more values of the one or more parameters.

18. The system (120) as claimed in claim 18, wherein the trained model learns trends/patterns related to the one or more parameters of the calls.

19. A User Equipment (UE) (110), comprising:
one or more primary processors (305) communicatively coupled to one or more processors (205), the one or more primary processors (305) coupled with a memory (310), wherein said memory (310) stores instructions which when executed by the one or more primary processors (305) causes the UE (110) to:
transmit, the plurality of calls to the one or more processors (205); and
wherein the one or more processors (205) is configured to perform the steps as claimed in claim 1.