Detection of fraudulent usage in wireless networks

The complexity of cellular mobile systems renders prevention-based techniques not adequate to guard against all potential attacks. An intrusion detection system has become an indispensable component to provide defense-in-depth security mechanisms for wireless networks. In this paper, by exploiting regularities demonstrated in users' behaviors, we present a suite of detection techniques to identify fraudulent usage of mobile telecommunication services. Specifically, we explore users' behaviors in terms of calling and mobility activities because they are two of the most important components of mobile users' profiles. To utilize users' calling activities, we formulate the intrusion detection problem as a multifeature two-class pattern-classification problem. Parameters including call-duration time, call inactivity period, and call destination are extracted to form a feature vector to reflect users' calling activities. A nonparametric technique known as the Parzen window with a Gaussian kernel, is used to estimate a class-conditional probability density function. A Bayesian decision rule is applied in order to achieve a desirable error rate. To effectively exploit movement patterns demonstrated by mobile users, we first propose a realistic network model integrating geographic road-level granularities. Based on this model, an instance-based learning technique is presented to construct mobile users' movement patterns. A user's movement history is stored and compared against newly observed movement instances. We then define a novel similarity threshold to classify users' current movement activities. We simulate users' various behaviors and provide simulation results.