Detection of Fraudulent Usage in Wireless Networks

Abstract—The complexity of cellular mobile systems renders prevention-based techniques not adequate to guard against all potential attacks. An intrusion detection system has become an indispensable component to provide defense-in-depth security mechanisms for wireless networks. In this paper, by exploiting regularities demonstrated in users ’ behaviors, we present a suite of detection techniques to identify fraudulent usage of mobile telecommunication services. Specifically, we explore users ’ behav-iors in terms of calling and mobility activities because they are two of the most important components of mobile users ’ profiles. To utilize users ’ calling activities, we formulate the intrusion de-tection problem as a multifeature two-class pattern-classification problem. Parameters including call-duration time, call inactivity period, and call destination are extracted to form a feature vector to reflect users ’ calling activities. A nonparametric technique known as the Parzen window with a Gaussian kernel, is used to estimate a class-conditional probability density function. A Bayesian decision rule is applied in order to achieve a desirable error rate. To effectively exploit movement patterns demonstrated by mobile users, we first propose a realistic network model inte-grating geographic road-level granularities. Based on this model, an instance-based learning technique is presented to construct mobile users ’ movement patterns. A user’s movement history is stored and compared against newly observed movement instances. We then define a novel similarity threshold to classify users’ current movement activities. We simulate users ’ various behaviors and provide simulation results. Index Terms—Bayesian decision rule, instance-based learning (IBL), intrusion detection, wireless network. I