Detecting suspicious call patterns

22 August 2008

Ian Brown brought my attention to a very interesting article from Daniel Soar in the London Review of books on the traffic analysis of mobile phone calls to detect suspicious activity and perform target selection for Lawful Interception. A particularly spicy bit:

“[…] Of the 50 million subscribers ThorpeGlenprocessed, 48 million effectively belonged to ‘one large group’: they called one another, or their friends called friends of their friends; this set of people was dismissed. A further 400,000 subscriptions could be attributed to a few large ‘nodes’, with numbers belonging to call centres, shops and information services. The remaining groups ranged in size from two to 142 subscribers. Members of these groups only ever called each other – clear evidence of antisocial behaviour – and, in one extreme case, a group was identified in which all the subscribers only ever called a single number at the centre of the web. This section of the ThorpeGlen presentation ended with one word: ‘WHY??’ […]”

What is of further interest is that Daniel Soar finds intuitive that patterns of movement or behaviours would  link even “fresh” pay-as-you-go phone to profiles of established users. This is one key finding of our recent paper about Identification via Location-Profiling in GSM Networks. In particular he describes a product that may already be doing something similar:

ThorpeGlen has a solution for that too. It also sells ‘profiling’ systems, which measure the behaviour pattern of an individual subscriber and, using statistical analysis, determine whether that same pattern is now appearing from another source. In other words, if your terrorist gets a new phone you’ll still know it’s him. If he keeps the same phone and starts changing his pattern, then he’s about to blow up Jakarta International Airport.”


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: