Communication industry has made the world a global village, and among all components of the industry, telecommunication is the most popular and most widely used [1] . It has created employment opportunities and empowered people economically and has removed distance, thereby saving lives and cost. Telecommunication has created opportunities for both the service providers and subscribers to do their separate but related businesses and earn their livings. But all these blessings do not come without some serious consequences of fraud in the business. Our interest in this paper is to detect fraud in the industry using the frequency and the duration of their calls. Fraud detection in telecommunication industry is vital to the survival of the industry. It is a common knowledge that fraudsters have flooded the telecommunication industries in various ways ranging from illegal access to bandwidth, attack on cyber securities, access to pocket of data, and illegal calls. All these constitute a huge loss to the telecommunication industries. These illegalities may force some of the service providers out of the industry if not properly checked. The multiplier effects of these fraudulent activities are massive loss of jobs, decline in the standard of living and its attendant consequences on those directly involved and others not directly involved. The most difficult aspect of these fraudsters is that they are smart and can hack into the data base of these service providers who should not sit back and watch them destroy their businesses. Since fraud is not localized, and does not have a permanent “office”, it can be committed at anywhere and at any time. Telecommunication operators store large amounts of data related to the activities of their subscribers. In these records, there exist both normal and fraudulent records. It is expected for the fraudulent activity records to be substantially smaller than the normal activity. If it were the other way around this type of business would be impractical due to the amount of revenue lost [1] .

This sector broadly has two types of users―domestic and commercial. There are cases where the connections are bought under domestic categories but the use is on a commercial scale. This causes substantial loss to the sector [2] . There is a need to adopt a data mining technique that will filter these fraudsters. Data volume has been growing at a tremendous pace due to advancements in information technology. At the same time there has been enormous development in data mining. Data mining can be defined as the process of extracting valuable information from data [3] . The telecommunication sector acquires huge amount of data due to rapidly renewable technologies, the increase in the number of subscribers and with value added services. Uncontrolled and very fast expansion of this field cause increasing losses depending on fraud and technical difficulties [4] .

Today, telecommunication market all over the world is facing a severe loss of revenue due to fraudsters [5] . To overcome such business hazards and to retain the market, operators are forced to look for alternative ways of using data mining techniques and statistical tools to identify the cause in advance and to take immediate actions in response. This can be possible if the past history of the subscribers were analyzed systematically. Fortunately, telecom industries generate and maintain a large volume of data such as Call detail data and Network data [6] . One reason for the non-utilization of this potential is the insufficient knowledge of the algorithms to be used on such data. Data mining tools and algorithms can be used to exploit the potential in the data when the data is synthesized efficiently. The advent of data mining algorithms and the development of software and hardware have led to an ease in analyzing huge and complex data [7] . Globally, the development of telecommunications industry is rapidly increasing with one innovation replacing another in a matter of years, months, and even weeks. Without doubt telecommunication is a key driver of any nation’s economy. Telecommunication is the communication of information by electronic means usually over some distance. It involves the transmission and receipt of information, messages, graphics, images, voice, video and data between or among telephones, internet, satellites and radio [8] .

In this area, some researchers have used different methods to determine both customer churn and fraud detection. Fraud detection and subscribers churn are related in the sense that both are concerned with subscriber’s behavior. Among the models used for data mining for both churn and fraud detection are naïve Bayes model; Gaussian probability distribution; Decision Tree algorithm; logistic regression and artificial neural network (ANN). Data mining is the extraction of vital information from the bulk of data available to the telecommunication industry and using an appropriate predictive model to classify and determine the behavior of subscribers. By refining the data and building an appropriate statistical model, so much hidden information about the subscribers and service providers will be unveiled, see [9] [10] [11] [12] . This information is very vital to the survival of any service provider such as MTN, GLO, ETISALAT, MTEL, etc., in the business of telecommunication, especially in Nigeria. We shall use the subscribers’ frequency of calls and the duration of such calls as parameters of interest in this paper. Then, we shall determine the prior and posterior probabilities of the subscribers and their number of calls at a given time. We shall develop a linear discriminant function which will be used to classify the posterior probability distribution into fraud and genuine subscribers. In this paper, we are concerned with statistical modeling and not machine learning or artificial intelligence method of classification.

Because of the privacy agreement between the service providers and subscribers on one hand and to protect the service providers’ respective businesses on the other hand, the service providers hardly disclose their data. But nevertheless, simulation offers a close substitute for real life data. Hence, in this paper, we simulate data that depict the real life scenario and use it for the study. We simulate data on number of calls per unit time, and the call duration and our interest is on the domestic subscribers only. Eighty (80) sample data points were simulated for the study. The samples were categorized into four (4) with each having twenty (20) observations representing subscribers. The number of calls per subscriber over a period of time was also simulated and these represent real life data and are used for this study. The sample data generated from such process look like real life data drawn from a real system. We employed MINITAB 16.0 for the simulation of the data in this work. A sample of 20 observations each on the average number of calls and rate given as follows; 8 (t = 3), 5 (t = 4), 9 (t = 12), 6 (t = 7), were simulated for the study. The values such as 8, 5,∙∙∙, 7 outside the bracket represent the average number of calls per hour, and the values in bracket represent the average duration of the entire calls in minutes. Our interest is to develop a predictive data mining model for fraud detection in telecommunication industry. The simulated data were categorized into two sample multivariate data groups A and B. Most importantly, service providers determine their customers’ behaviour from the nature of their current calls and their past behaviour.

We need to know the history of these subscribers based on the information available to the network providers (service providers). This information is basically obtained from their call history. For this reason, the appropriate probability model that has a memory and can capture such a past history and relate it to the current history of subscribers’ is the Bayesian statistic model. However Bayesian statistics requires a prior probability. Some researchers make mistake of estimating the prior probability in this type of study using a continuous distribution as though the number of calls belong to a continuous random variable. Actually, the number of calls is a Poisson problem and therefore belongs to a discrete probability distribution. The value of Poisson random variables are the non-negative integers, and any random phenomenon for which a count is of interest can be modeled by assuming a Poisson distribution, provided that the random variables satisfies certain assumptions regarding the distribution [13] . Example of such a count includes the number of telephone calls per unit time coming into the switch board of a large business. Hence, we shall estimate the prior probabilities using Poisson distribution. Since each subscriber’s number of calls and time involved have non-stationery increment, we assume a non-homogenous Poisson process (NHPP) with parameter ( ω t ) , where, ω is the call rate and t is the time duration for the calls. This has been tested and the shape parameter b was found to be greater than zero. The intensity function of power law process model ( ω ( t ) = a b t b − 1 ) can be used to describe the intensity of a NHPP. The power law process model has the mean and intensity function as

Λ ( t ) = a t b and ω ( t ) = d Λ ( t ) d t = a b t b − 1 (1)

The parameters of the model are obtained by log linear transformation of the mean value function.

ln Λ ( t ) = ln a + b ln t (2)

and a plot of ln Λ ( t ) against ln(t) will yield the value of ln(a) as the intercept and b as the slope of the linear graph. If the shape parameter b = 1, there is a stationary increment and we have HPP( ω ) but for b > 1, we have NHPP( ω t) [14] . Hence, the predictive probability model for the priors is:

P n ( t ) = exp { − a b t b − 1 } [ { a b t b − 1 } n ] / n ! ; n = 0 , 1 , ⋯ (3)

[15] , where P_n(t) = the probability of n number of calls at a given time (t) and the other notations retain their usual meaning as defined before.

The following assumptions must be satisfied by the random variables before we can use Equation (3) above:

Model Assumption:

The stochastic process { N ( t ) , t ≥ 0 } is called a non-homogeneous Poisson Process with rate function { ω ( t ) , t ≥ 0 } if

1) N ( 0 ) = 0 : (The number of events at time zero is equal to zero).

2) { N ( t ) , t ≥ 0 } has independent increment: (The number of events in non-overlapping time interval are independent).

3) lim h → 0 o ( h ) h = 0 : (o(h)―some function of smaller order than h which satisfy the limit).

4) P { N ( t + h ) = k + 1 / N ( t ) = k } = λ ( t ) ⋅ h + 0 ( h ) : (The probability that exactly one event will occur in a small interval of length t + h approximately equal to λ ( t ) ⋅ h + 0 ( h ) ).

5) P { N ( t + h ) = k / N ( t ) = k } = 1 − λ ( t ) ⋅ h + 0 ( h ) : (The probability that no event occur in a small interval of length t + h).

6) P { N ( t + h ) = k + j / N ( t ) = k } = o ( h ) ; j ≥ 2 : (The probability that more than one event will occur in a small interval of length t + h).

7) The events must occur at random [16] .

Bayesian statistics model is adapted for the posterior distribution since it has the attribute of capturing the prior behaviour of these subscribers to determine their current behaviour. Hence, the predictive statistical model for this study is

P ( ψ = ζ / ω ) = P ( ζ / ω ) P ( ω ) ∑ ω = 0 n P ( ζ / ω ) P ( ω ) (4)

where P ( ψ = ζ / ω ) = the conditional probability that the random variable ψ assumes a specific value ζ given that its prior probability was ω . Note that ω is now a random variable. ∑ ω = 0 n P ( ζ / ω ) P ( ω ) = the joint probability distribution of the subscribers [17] .

Our interest is to classify the subscribers as either genuine or fraudulent. Hence, this is a classification problem and linear discriminant analysis will be employed to classify the subscribers where they belong. This classification will enable service providers to determine the measures to take against these fraudsters. The discriminant analysis will discriminate between the legitimate subscribers and fraudulent ones within the network. The idea of discriminant analysis is a search for the differences in two or more groups that consist of multivariate measurements. One (or more) linear function(s) which maximally differentiate(s) between these groups are constructed. These functions are then used to classify new member of similar group into the appropriate group they belong and differentiate them from the group they do not belong to [18] . The linear discriminant function employ is given in Equation (5).

β = X T S − 1 ( μ ( 1 ) − μ ( 2 ) ) (5)

where X T = ( X 1 ⋯ , X p ) ; S − 1 is the inverse of the dispersion (variance-covariance) matrix and μ ( 1 ) − μ ( 2 ) is the difference in the mean vectors between the two multivariate samples and β is the linear discriminant function. We established the optimal classifier of the discriminant function and finally classify the sample data accordingly based on their posterior probability distributions. Two multivariate sample data with two variates will be derived from Equation (4). The two sample multivariate data with two variates each are the posterior probabilities of each group. Then, we shall classify the samples as belonging to either genuine or fraudulent subscribers based on the optimal classifier ( β A + B ). Our classification rule will be: classify the subscribers in group A into “A₁; A₂”, where A₁ is the fraudulent subscribers and A₂ is the genuine subscribers. Similarly, we do the same for group B designated by “B₁; B₂”. Fraud subscribers tend to make use of the services much more than the genuine subscribers and should therefore have higher probability distributions.

Definitions:

Subsc = subscribers.

n-call = the number of calls per subscriber per hour.

t (min) = the time spent on the calls.

Prop.n (n/N) = fraction of the number of calls in relation to the total number of calls.

Pr.of Prio = the probability of priors.

joint prb = the joint probabilities.

Posterior = the posterior probabilities.

Churn = the defection of subscribers from one network to another.

The average number of calls and time spent in each call are presented in Table 1.

A plot of ln(t) against ln( ω t ) is presented in Figure 1.

From Figure 1, we found that the slope, b = 1. And from the relationship in Equation (2) and Figure 1, we have that ln(a) = 2.2. Hence, a = exp ( 2.2 ) = 9.0250

The implication of the shape parameter being 1 indicate that the intensity function has stationery increment, through the PLP transformation; hence, this distribution follows HPP(ω) and the prior probability distribution of Equation (3) becomes

P n ( t ) = exp { − 9.0250 } [ { 9.0250 } n ] / n ! (6)

Equation (6) is presented in Table 2 by the column labeled “Prob” and Equation (4) is presented in Table 2 by the column labeled “Poste.Pr”.

Table 2 presents the number of calls per hour, the probability distribution, the joint probability distribution, the prior and posterior probability distributions.

The average number of calls and time spent in each call are presented in Table 3.

A plot of ln(t) against ln( ω t ) is presented in Figure 2.

From Figure 2, we determine the slope, b = 1. From the relationship in Equation (2) and Figure 2, we have that ln(a) = 1.7. Hence, a = exp ( 1.7 ) = 5.4739 .

The prior probability distribution in Equation (3) becomes

P n ( t ) = exp { − 5.4739 } [ { 5.4739 } n ] / n ! (7)

Equation (7) is presented in Table 4 by the column labeled “Prob” and Equation (4) is presented in Table 4 by the column labeled “Poste.Pr”.

Table 4 presents the number of calls per hour, the probability distribution, the joint probability distribution, the prior and posterior probability distributions.

The average number of calls and time spent in each call are presented in Table 5.

A plot of ln(t) against ln( ω t ) is presented in Figure 3.

From Figure 3, we determine the slope, b = 1. From the relationship in Equation (2) and Figure 3, we have that ln(a) = 2.1. Hence, a = exp ( 2.1 ) = 8.1662

The prior probability distribution in Equation (3) becomes

P n ( t ) = exp { − 8.1662 } [ { 8.1662 } n ] / n ! (8)

Equation (8) is presented in Table 6 by the column labeled “Prob” and equation (4) is presented in Table 6 by the column labeled “Poste.Pr”.

Table 6 presents the number of calls per hour, the probability distribution, the joint probability distribution, the prior and posterior probability distributions.

The average number of calls and time spent in each call are presented in Table 7.

A plot of ln(t) against ln( ω t ) is presented in Figure 4.

From Figure 4, we determine the slope, b = 1. From the relationship in Equation (2) and Figure 4, we have that Ln(a) = 1.58. Hence, a = exp ( 1.58 ) = 4.8550

The prior probability distribution in Equation (3) becomes

P n ( t ) = exp { − 4.8550 } [ { 4.8550 } n ] / n ! (9)

Equation (9) is presented in Table 8 by the column labeled “Prob” and Equation (4) is presented in Table 8 by the column labeled “Poste.Pr”.

Table 8 presents the number of calls per hour, the probability distribution, the joint probability distribution, the prior and posterior probability distributions.

Table 9 presents the posterior probability distributions for the two multivariate groups A and B.

The variance-covariance matrix with two variates is given as:

( n i − 1 ) S i 2 = [ ∑ x 1 2 − n x ¯ 1 2 ∑ x 1 x 2 − n x ¯ 1 x ¯ 2 ∑ x 1 x 2 − n x ¯ 1 x ¯ 2 ∑ x 2 2 − n x ¯ 2 2 ]

where n₁ and n₂ respectively stand for the first and second samples respectively [16] .

The variances are: X 11 = ∑ 1 20 X 1 2 − n X ¯ 1 2 ; X 22 = ∑ 1 20 X 2 2 − n X ¯ 2 2

The co-variances are: X 12 = X 21 = ∑ 1 20 X 1 X 2 − n X ¯ 1 X ¯ 2 ;

The observed sample multivariate data are the respective posterior probabilities of the four groups, the tendency is that their respective means will be equal thereby making the difference in the means vector to be zero. The reason behind this is that the sum of probabilities is one (1). But we can overcome this by observing the sample data carefully. Any of the sample point that cannot be approximated to two decimal places (2.d.p) with value is regarded as zero, and the sample size adjusted accordingly. Hence from sample A; delete serial number 19 from column 2; therefore, variate 1 has n = 20 and variate 2 has n = 19. Similarly, from sample B; delete serial numbers 3 and 13 from column 2; therefore, variate 1 has n = 20 and variate 2 has n = 18. The adjusted variance-covariance matrix for sample A are:

variances: X 11 = ∑ 1 n X 1 2 − n X ¯ 1 2 ; , X 22 = ∑ 1 n − 1 X 2 2 − ( n − 1 ) X ¯ 2 2

co-variances: X 12 = X 21 = ∑ 1 n − 1 X 1 X 2 − n 1 + n 2 2 X ¯ 1 X ¯ 2 ;

And

The adjusted variance-covariance matrices for sample B are:

Variances: X 11 = ∑ 1 n X 1 2 − n X ¯ 1 2 ; X 22 = ∑ 1 n − 2 X 2 2 − ( n − 2 ) X ¯ 2 2

co-variances: X 12 = X 21 = ∑ 1 n − 2 X 1 X 2 − n 1 + n 2 2 X ¯ 1 X ¯ 2 ;

The above is a symmetric matrix, where the diagonal elements are the variances. The upper and lower entries are the covariance. The values of the matrices are presented below.

From sample A and B, we have:

X ¯ ( A ) = [ 0.05 0.05255 ] ; X ¯ ( B ) = [ 0.05 0.055382 ]

( n A − 1 ) S A 2 = [ 0.0039 − 0.0012 0.0029 ]

From sample B, we have:

( n B − 1 ) S B 2 = [ 0.0129 − 0.0048 0.0053 ]

The pooled sample dispersion matrix is

( n A + n B − 2 ) S A + B = [ 0.0168 − 0.00168 0.0082 ]

The dispersion matrix is

S A + B = [ 0.0004541 − 0.00004541 0.0002216 ]

The inverse of the dispersion matrix is

S A + B − 1 = [ 2248.229 460.70423 4607.0423 ]

The linear discriminant function is

β = X T S A + B − 1 ( x ¯ ( 1 ) − x ¯ ( 2 ) ) T

The differences in the sample mean vector for sample A and B

X ¯ ( A ) − X ¯ ( B ) = [ 0 0.002832 ]

Since the variates are the posterior probabilities which cannot be negative, the difference in the mean vector cannot be negative.

β = X T S A + B − 1 ( X ¯ ( A ) − X ¯ (B) )

β = ( X 1 X 2 ) [ 2248.229 460.70423 4607.0423 ] [ 0 0.002832 ]

β = 1.30471 x 1 + 13.0471 x 2

β A = 1.30471 ( 0.05 ) + 13.0471 ( 0.05255 ) = 0.7509

β B = 1.30471 ( 0.05 ) + 13.0471 ( 0.055382 ) = 0.7226

The optimal classifier for discrimination is

β A + B = 1 2 ( β A + β B )

β A + B = 1 2 ( 0.7509 + 0.7226 ) = 0.7368

Classify subscribers in group A whose posterior probability is 0.7368 and above into group A₁ and those whose posterior probability falls below 0.7368 into group A₂. Also classify subscribers in group B whose posterior probability is 0.7368 and above into group B₁ and those whose posterior probability falls below 0.7368 into group B₂.

The subscribers that belong to A₁ and B₁ are the fraudulent subscribers while those that belong to A₂ and B₂ are the legitimate subscribers. From the sample observations in Table 9(A) and Table 9(B), all the subscribers are legitimate because their posterior probabilities are less than the optimal classifier β A + B .

The authors declare no conflicts of interest regarding the publication of this paper.

Amuji, H.O., Chukwuemeka, E. and Ogbuagu, E.M. (2019) Optimal Classifier for Fraud Detection in Telecommunication Industry. Open Journal of Optimization, 8, 15-31. https://doi.org/10.4236/ojop.2019.81002