Call Me: Gathering Threat Intelligence on Telephony Scams to Detect Fraud
summary
A telephony honeypot records over 8 million unsolicited calls, logs 600,000 calls/month and records 100,000 calls to build labeled data; transcripts go through TF‑IDF, latent semantic indexing and spectral clustering to group identical campaigns, then a phone printing classifier extracts ~150 audio features and uses a kernel model (CDI for transcription) to fingerprint devices. Results show 51% of robocalls come from 38 infrastructures, with cluster models achieving about 85% true positive rate at 0.25 false positive rate.
AI-written summary · about
chapters (24)
- 0:00Intro
- 1:23Outline
- 5:28Phoneypot IN ONE MONTH
- 8:34PHONEYPOT VS ONLINE COMMENTS
- 10:10System Overview
- 11:19System Details
- 12:34Call Transcription & processing
- 13:13Natural Language Processing
- 15:12Examples of Topics from Robocalls
- 16:26Keywords are too noisy
- 17:47Clustering of transcripts similarity matrix
- 19:04Cluster extraction
- 20:02Cluster Phoneprinting
- 22:10Phoneprints are voice agnostic
- 24:34Phoneprinting distinct telephony infrastructures
- 27:32Google-related scams
- 28:52Sharon, your Google specialist
- 30:11Google Business Listing
- 30:43Debt Collectors
- 31:47Election year
- 34:21Automating scamy spam detection and tracking
- 38:56Conclusion
- 39:36Acknowledgements & Questions
- 46:16Experiment Overview
related talks
54mLifecycle of a Phone Fraudster: Exposing Fraud Activity
49mChipmunk or Pepe? Using Acoustical Analysis to Detect Voice-Channel Fraud
50mWinning the Battle Against Scam Calls – How We Mitigated Caller ID Spoofing
51mKnowing The Robocallers: Illegal Call Centers And Efforts To Stop Them
40mTaking Back Your Brand: New Techniques to Stop Robocallers
39mSynthetic Trust: Exploiting Biases at Scale
45mVoice Security - Get Up to Speed on This Attack Vector
20mSecurity in the Age of AI: Response and Strategy