Detecting Telephone Subscribers with Abnormal Behaviour Through Network Properties Analysis

Abstract

Abstract. The use of telephone subscriber networks for fraud, sales of goods and services, and spam leads to annual financial losses of billions of dollars worldwide. The problem was studied back in 1996 and is still relevant today, despite many methods of counteraction and protection. Traditional methods, such as blocking lists and call frequency monitoring, are often ineffective against spammers who bypass these systems by changing their behaviour patterns. Objective. The purpose of the work is to study the use of subscriber network properties, such as clustering coefficients, centrality, and average shortest path length, as criteria for identifying subscribers with abnormal behaviour in a dynamic telephone network. Research methods. Modeling and numerical experiment. Results. The study shows that the global clustering coefficient is a sensitive measure for detecting the presence of spammers in the network. Its value decreases significantly when spammers appear. When classifying subscribers into normal and spammer using the Random Forest model, the most important properties are the local clustering coefficient, average shortest path length, degree and centrality of the subscriber in the network. According to the telephone network modeling data, it was found that with a measurement window size of 4 days, the classifier accuracy (F1 score) and the accuracy of detecting spammers (TPR) reached values of 80%. Conclusions. Using the network characteristics of subscribers has a positive effect on the accuracy of detecting subscribers with abnormal behaviour, but it takes time for spammers and normal subscribers to become distinguishable by network characteristics.