Behavior-Based Online Anomaly Detection for a Nationwide Short Message Service

As fraudsters understand the time windows and act fast, real-time fraud management systems becomes necessary in the Telecommunication Industry. In this work, by analyzing the traces collected from a nationwide cellular network over a period of a month, an online behavior-based anomaly detection system is provided. Over time, users' interactions with the network provide a vast amount of data usage. This data usage is modeled to profiles by which the users can be identified. A statistical model is proposed, which allocates a risk number to each upcoming record, which reveals deviation from the normal behavior stored in profiles. Based on the amount of this deviation, a decision is made to flag the record as normal or abnormal. If the activity is normal, the associated profile is updated; otherwise, the record is flagged as abnormal, and it will be considered for further investigations. For handling the big dataset and implementing the methodology, we used the Apache Spark engine, which is an open source, fast, and general-purpose cluster computing system for big data handling and analysis. The experimental results show that the proposed approach can perfectly detect deviations from the normal behavior, and can be exploited for detecting anomaly patterns