Ahmed Seid Yesuf
email: ahmed.yesuf@m-chair.dewww.m-chair.de

Jetzabel Serna-Olvera
email: jetzabel.serna@m-chair.dewww.m-chair.de

Kai Rannenberg
email: kai.rannenberg@m-chair.dewww.m-chair.de

Using Fraud Patterns for Fraud Risk Assessment of E-services

Keywords: Fraud Pattern, Risk Assessment, Security, Fraud, E-service

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Over the past years, security and risk assessment have become essential requirements in the successful development of information systems and electronic services of enterprises [START_REF] Zuccato | Service Security Requirement Profiles for Telecom: How Software Engineers May Tackle Security[END_REF]. In particular, since e-services (e.g. Internet marketing, telecommunication services and banking services) are delivered using technological means, it is of utmost importance to perform risk assessment in order to minimise or even prevent risks. One of the most relevant forms of risks which prevail in a wide range of e-service domains is fraud risk [START_REF] Rebahi | A survey on fraud and service misuse in voice over ip (voip) networks[END_REF]. Fraud risk is a complex combination of social, financial and technological risks including misuses resulting from the flaws and weaknesses of e-services themselves. Therefore, preventing fraud is extremely relevant, since fraud negatively affects the global e-service revenue; for instance, in 2015, fraud affected the global Telecom revenue by almost $38.1 billion (USD) [START_REF]CFCA: Global telecom fraud report[END_REF]. Thus, risk assessment is essential not only to counter fraud but also to keep e-services profitable and secured [START_REF] Yesuf | A Review of Risk Identification Approaches in the Telecommunication Domain[END_REF][START_REF] Yesuf | Fraud Risk Modelling: Requirements Elicitation in the Case of Telecom Services[END_REF].

Typically, frauds are perpetrated by individuals, organised groups of individuals, employees or third parties with a set of goals targeting the weak parts of e-services [START_REF] Abdallah | Fraud detection system: A survey[END_REF]. For an individual who has a service contract with a service provider and uses it for individual purposes, the goal of perpetrating fraud is limited to individual benefit (e.g. using the service without/little payment). Beyond the individual benefit, organised fraudsters can potentially disrupt the business process of an enterprise (e.g. by colluding with third parties). In order to achieve their goals, they target customers, infrastructures of service providers (e.g. Private Branch Exchange -PBX systems), the service or product itself (e.g. service plan, credit card) and the entities involved in the process of delivering the eservices.

Until recently, a number of researches has focused on fraud detection methods such as [START_REF] Hilas | An application of supervised and unsupervised learning approaches to telecommunications fraud detection[END_REF][START_REF] Ruiz-Agundez | Fraud detection for voice over ip services on next-generation networks[END_REF][START_REF] Farvaresh | A data mining framework for detecting subscription fraud in telecommunication[END_REF]. In [START_REF] Rebahi | A survey on fraud and service misuse in voice over ip (voip) networks[END_REF] and [START_REF] Abdallah | Fraud detection system: A survey[END_REF], authors present an extensive review and comparison of fraud detection approaches. Contrary to the many approaches which exist in fraud detection, fraud risk assessment has not been the target of many works. Authors in [START_REF] Ionita | Using value models for business risk analysis in e-service networks[END_REF] and [START_REF] Ionita | Value-driven risk analysis of coordination models[END_REF] have focused on fraud risk assessment. They proposed a value-based approach which can be used to identify and prioritise frauds, in particular, those occurring due to collusion with third parties. Although authors identified and focused on one of the most recurrent patterns that fraudsters use, they pointed out the need of performing fraud risk assessment with other types of fraud patterns in order to strengthen the security of e-services.

Considering that and given the wide range of methods and techniques to perpetrate fraud in e-services, fraudsters are able to use common but interchangeable patterns to achieve their goals. Thus, in this paper, we identify six fraud patterns from an e-service domain -the Telecom services. We therefore demonstrate how fraud patterns could be used to perform risk assessment of e-services and serve as a tool for preventing fraud risks.

The rest of the paper is organised as follows. Section 2 highlights concepts of fraud, e-services and fraud assessment in e-service. Section 3 presents the main methodology followed to produce the fraud patterns and use them towards fraud risk assessment. Section 4 describes the fraud domain model used to ease the interpretation of frauds. Section 5 presents an overview of the fraud incidents observed to identify the fraud patterns. Section 6 presents the identified fraud patterns followed by the application of the fraud patterns in a given scenario, namely Telecom services, which is then introduced in Section 7. Section 8 discusses the main advantages of this approach and highlights the open challenges and the limitations of the proposed approach; followed by the main conclusions of this paper in Section 9.

Background

Fraud risk in e-services

Fraud has several meanings that depend on the contexts. According to the Fraud Advisory Panel (www.fraudadvisorypanel.org), an anti-fraud community based in England, "fraud is the deliberate use of deception or dishonesty to deprive, disadvantage or cause loss (usually financial) to another person or party". While this definition can be applied to a wide extent of auditing fraud, the Communication Fraud Control Association (CFCA) [START_REF]CFCA: Global telecom fraud report[END_REF] has defined fraud as "the use of telecommunication services or products with no intention of payment". Therefore, fraud risks in e-services are understood as events that allow fraudsters to misuse the service either to gain personal benefit or to the benefit of organised fraudsters. In this paper, we focus and explore those fraud risks that have impact on the service providers from the perspective of fraudsters.

Fraud Risk Assessment

Based on ISO 31000 [START_REF]Risk Management -Principles and Guidelines[END_REF], the risk management process includes five processes: establish context, risk assessment, risk treatment, monitoring and review, and communication and consulting. Risk assessment is an integral part of the risk management process, which is the concept of managing risks against enterprise objectives. More specifically, fraud risk assessment (FRA) is defined as the process of identifying, analysing and estimating fraud risks in a service.

Considering the impact of fraud on service providers, it is essential to prevent, detect and prepare the appropriate counter-measures. There exist a number of different approaches for fraud detection [START_REF] Abdallah | Fraud detection system: A survey[END_REF] [2]; however, preventing fraud through identifying and analysing business processes, transaction flows and other entities, still lacks the focus of the research community [START_REF] Yesuf | A Review of Risk Identification Approaches in the Telecommunication Domain[END_REF].

Fraud Patterns

The concept of patterns for security was initially introduced by Yoder and Barcalow [START_REF] Yoder | Architectural patterns for enabling application security[END_REF]. The authors proposed seven security patterns that software developers should consider when developing their software applications. Since then, different types of security patterns were proposed (e.g. patterns for cryptography and access control [START_REF] Braga | Tropyc: A pattern language for cryptographic software[END_REF]). "A security pattern describes a particular recurring security problem that arises in specific contexts, and presents a well-demonstrated generic solution for it" [START_REF] Schumacher | Security Patterns: Integrating security and systems engineering[END_REF]. As such, the use of patterns has benefited security in several areas including software development. Inspired by this concept, we developed fraud patterns from the recurring fraud risks in the e-service domain. Fraud patterns not only help to describe recurring fraud risks in e-services but increase the potential of having in place preventive solutions. As a first step we have focused on the identification of the most relevant fraud risks.

Methodology

The whole process of a service provider from services delivery to the service payment process can be considered as a system. In such systems, one of the main challenges that directly or indirectly affect the revenue of service providers is fraud. Fraud risks are enabled when the weaknesses of the valuable assets (including their service) of service providers are exploited by fraudsters. Fraud risk assessment (FRA) is an approach to reduce the effects of fraud risks substantially -which is the goal of service providers. To develop a FRA approach, it is necessary to first develop a domain model or ontology of concepts related to fraud risks of such systems. Thus, we first adopted and extended the model introduced by [START_REF] Dubois | A Systematic Approach to Define the Domain of Information System Security Risk Management[END_REF]. By extending this model, we were able to develop a domain model specific for FRA. The domain modelling allowed us to better describe fraud risks in a particular domain. We considered the Telecom domain, and analysed five real fraud incidents in this domain. The analysed fraud incidents are business-related and are the result of different types of Telecom services (e.g., voice, PBX, roaming and Internet services). To develop the patterns, we applied the FRA domain modelling and interpreted the real fraud incidents. We identified six recurring and relevant patterns currently used by most fraudsters and actually present in more than one fraud incident. Finally, the applicability of the identified patterns is demonstrated by modelling the entities involved in the use case (Telecom domain scenario) and directly applying the fraud patterns to the model.

Fraud Risk Assessment Domain Model

In Information Systems Security Risk Management (ISSRM) [START_REF] Dubois | A Systematic Approach to Define the Domain of Information System Security Risk Management[END_REF] there exist different concepts that can easily be interpreted as concepts of FRA. The three groups of concepts mentioned in ISSRM -risk-based, asset-based and treatmentbased concepts -could be adapted to the FRA domain model into concepts of fraud, assets and preventive measures. Based on this model, we defined a FRA domain model as shown in Fig. 1.

Concepts related to fraud -Fraud enabler -is the potential weakness or possibility that enables a fraud to happen when exploited by a fraud agent. -Fraud agent -is a fraudster or attacker who acts as an agent to perpetrate the fraud. A fraud agent uses fraud method and exploits fraud enablers. -Fraud method -is an approach that a fraud agent follows to perpetrate the fraud.

-Fraud threat -is the combination of fraud agent and one or more fraud enablers. It targets one or more assets and its frequency/likelihood contribute for a fraud risk to happen. -Fraud risk -is the combination of a fraud threat with one or more fraud enablers which negatively impacts one or more of the assets -direct or indirect assets. -Impact -the negative effect of a fraud risk that harms one or more of the assets of the service provider. The impact on service provider can be interpreted in terms of money or reputation, by which both affect the revenue of the service provider.

Concepts related to assets

-An asset is any valuable entity of a service provider which could be targeted by one or more fraud agents (attackers/fraudsters); assets can be direct or indirect.

-Direct Assets can be directly estimated when affected by fraud; they include income of a service provider or revenue/income for a given service (e.g. call, messaging, data, Internet services) by a service provider.

-Indirect Assets cannot be directly estimated when affected by fraud; they include reputation and customer data. -Security objective -is the protection measure that is applied to one or more assets. From the perspective of service providers, the security objectives include protection of direct and indirect assets including confidentiality, integrity and availability of services, prevention of service misuses and customer data protection (privacy).

Concepts related to preventive measures

-Preventive measure -is a part of fraud risk management; it is not part of a FRA. We include it into the domain model as it contributes to show the importance of FRA (e.g. preventive requirement specification based on FRA). It describes the treatment approach to a given fraud risk. This can be achieved by: -producing a prevention requirement -potential prevention requirements that need to be implemented in the system to protect the assets of the service provider, and/or -producing a new or modified policy -which is designed based on the assessment results of FRA. It could be enforced at the service level, organisational level, or customer level.

Modelling the Telecom e-services domain

The FRA domain model is applicable to different types of e-service domains (e.g. health insurance, Internet marketing, Telecom), where fraud is part of the risks of the respective services. In this paper, we considered the Telecom domain. In this domain customers subscribe to Telecom services. In the process of delivering the services, the Telecom providers are suffering from different types of frauds leading to important revenue loss [START_REF] Rosas | Telecommunications fraud: Problem analysis-an agentbased kdd perspective[END_REF] [3] [START_REF] Ghosh | Telecoms fraud[END_REF].

Fraud scenarios

Due to space limitation, we briefly describe the five scenarios spanning different types of real frauds. In the next subsection we further focus on two of the most relevant frauds, which are then interpreted using the domain model in Tables 1 and2.

Fraud case 1. Name: Service plan misuse with the involvement of a third party Target: Income of the targeted Telecom service provider Goal: To gain financial benefit and use the service without payment.

Fraud case 2. Name: Identity theft to use the call-forwarding functionality of (a) post-paid contract(s) Target: Income of the targeted Telecom service provider Goal: Call selling, using service without payment Table 2. Fraud case 4. abusing fixed line network credentials during service set-up process of an Internet access service (DSL connection)

Description

A fraudster orders a land-line Internet connection with a Telecom provider. In doing so, he uses fake customer data.

An order confirmation will be sent to the fraudster's address, stating a service connection date. Sometime before a technician visits the place, fixed line network credentials will be sent via letter to the fraudster. The fraudster takes the credential letter as soon as it arrives and uses the respective credentials for SIP authentication, logging on to the TSPs telephony server from another location (securing its anonymity). Financial damage Preventive measure -The message conversations between the customer and the service provider should be certified.

-Start the service once the apparatus is configured -The credentials must be sent only to legal user with certified identify.

Fraud case 3. Name: Stealing credentials to make unauthorised calls from a PBX system Target: Credentials of the PBX system and income of the Telecom service provider Goal: Financial gain (e.g. by call selling) and using service without payment

Fraud pattern development

In order to identify the fraud patterns, we modelled the Telecom domain using the five aforementioned scenarios. We have interpreted these frauds using the fraud domain model developed in Section 4. Tables 1 and2 show the modeling of two of the five scenarios. Note that the goals of fraudsters are diverse, but we only focused on those which have an important effect to the Telecom service provider.

Fraud Risk Patterns (FRPs)

Fraud risk patterns (FRPs) are similar to security patterns described in [START_REF] Schumacher | Security Patterns: Integrating security and systems engineering[END_REF] [19], which describe a particular recurring security problem that arises in specific contexts, and present a well-proven generic solution for it. In our context, we are interested in recurring fraud risks against the valuable assets of service providers.

After defining each of the five fraud incidents using the FRA domain model (cf. Section 4), we have observed each of the fraud cases and found a list of recurring fraud enablers targeting the assets of the Telecom (e.g. the service itself and the income). Fraud agents (fraudsters) have different goals in perpetrating a fraud, most of them target the Telecom service to gain a lot of moneywhich indirectly affects the income of the Telecom for that specific service. Each of the fraud cases has security objectives and can mainly be categorised into three security objectives: misuse protection, CIA (confidentiality, integrity and availability) and privacy (data protection). In the process, we produced three groups of FRPs: patterns related to service-misusing, patterns due to system vulnerabilities and patterns related to privacy (data protection). In this paper, we are interested analysing the first two groups of patterns. The FRPs identified below are distributed across the five fraud cases.

Patterns related to *service-misusing* FRP 1 -Impersonation (of customers or service providers): Context. This describes a situation where a fraudster pretends as a legal customer or a representative from a service provider to achieve his/her goal. In the Fraud case 3, for instance, the fraudster provides wrong information about his personal information including the address to impersonate a legal customer in order to get credentials necessary to commit the fraud. Beyond this, the fraudster can have a different approach to get the credentials by impersonating the technician of the service provider to get the credentials from a legal customer. Target. This pattern targets customers and service providers. It is observed in the Fraud cases 3,4 and 2.

FRP 2 -Time interval-based misuses: Context. In this pattern, the fraud is perpetrated following the availability of a service without the knowledge of the service provider or in a condition where the service provider could not recover the damage caused by the fraud. In Fraud case 4 (see Table 2), for instance, the service provider sends the call credentials before the necessary infrastructure is configured at the customer place, while the service is activated and available to be used. In the case of VoiP telephony, the credentials are enough to set up a remote connection and perform the fraud. Obviously the main fraud enabler is the availability of the service before it is accountable to the customer. Note: This kind of fraud could also be exploited by a third party -stealing the credentials, in which case it follows FRP1. Target. The target of this pattern is generally time-dependent activities. It is observed in the Fraud cases 4 and 5. FRP 3 -Misusing the service by overdoing beyond the expected limit: Context. In this pattern, a fraudster uses the service beyond the expected usage limit of "normal" customers. For example, in a service plan misuse case, a fraudster tries to generate a lot of call traffic while keeping himself undetected by the fraud detection system installed at the service provider side. This is a very common fraud that a Telecom service provider is facing, which needs careful service planning. Target. The target of this pattern is the service and its tariff plan. We observed this kind of fraud pattern in all of the Fraud cases 1 to 5. FRP 4 -Fraud due to invisible collusions: Context. In this pattern, a fraudster perpetrated the fraud in an organised entity where other customers or service providers are involved directly or indirectly to gain financial benefit. A rational fraudster uses all possible ways of getting the benefit from the service either by installing a PBX system that helps to sell calls or randomly generating calls to expensive destination. In this case, the fraudster will make an agreement with a third party (mostly another Telecom service provider) to terminate calls to expensive destinations. In return, the fraudster gets his income share generated by committing the fraud with the third party. Target. This pattern targets the service providers and the weaknesses on their services. It is observed in the Fraud cases 1, 2 and 5.

Patterns due to *vulnerabilities of the system* FRP 5: Unsecured (uncertified) communication Context. This describes a fraud pattern due to lack of secure communication between different business entities in a given context. For instance, when a user has a possibility to register as a new customer via the Internet, the user might use a forged identity and delivery address unless the system implements a way of user certification. This allows fraudsters to trigger the process of creating a contract or an account to gain the advantages that a forged identity can get. Target. This pattern targets the communication channel between entities in the e-service. It is observed in the Fraud case 4. FRP 6: Exploiting infrastructure vulnerabilities: Context. This is a situation where technical weaknesses of the infrastructure at a service provider or at a customer point contribute to a fraud. In Fraud case 3, for instance, a weak configuration of the remote access policy of the PBX system is the main triggering factor for fraudsters to target the PBX. Target. This fraud pattern targets the infrastructures used to deliver the eservices. It is observed in the Fraud cases 3 and 4.

Application of FRPs to Telecom Services

So far, we have presented fraud patterns identified from the real fraud incidents. In this section, we use an e-service from the Telecom domain, namely the roaming service, to apply the fraud patterns and show how they could be used for fraud risk assessment. To do the fraud risk assessment, first the necessary entities need to be described. Then, for each fraud pattern, the potential fraud risks would be identified. At last, the potential fraud risks should be estimated based on their impact on the service provider.

Case study description

Roaming is one of the Telecom services which allows customers to use calling and messaging services while they are abroad. It involves different independent actors: the customer, the visited and the home service provider. We focus on the calling service of roaming for the sake of simplicity.

The customer. A customer creates a contract (either flat-rate or pre-paid) with the home service provider to get call services -roaming. He is responsible to pay for the services he has used.

The home service provider (HSP). A HSP is responsible for providing calling services to their customers within the coverage of customers' contract. The HSP maintains the usage data of customers including access locations in a databasehome location register (HLR). To prepare the invoice for the roaming service of a customer, the HSP should receive call detail records (CDR) from the visited service provider. The CDR is the usage data of a customer stored in the visited service provider. The payment for the roaming service is based on the number of minutes that the customer calls while roaming.

The visited service provider (VSP). A VSP will have a roaming service agreement with the HSP to provide roaming service to the customers of the HSP when the customers use the service within the VSP network. The VSP is responsible for storing and sending the CDRs of the customer to the HSP. Based on technologies implemented at the VSP, the reporting time varies. According to the technology Near-Real-Time Roaming Data Exchange (NRTRDE), the time to report is limited only to four hours.

Entities in the case study The e-service under assessment can be represented in a structural model, which represents the necessary entities for the assessment. Each of the fraud pattern targets a specific set of e-service entities such as actors, activities, services, communication channels and infrastructures. Finding a suitable modelling language to handle all types of e-service entities is a future work. An example model to represent the relations between actors in a semi-structured model is shown Fig. 2.

-Actors. Customer (type: human), HSP (type: service provider), and VSP (type: service provider). The actor HSP can be expressed with its employees such as customer services, technicians and commercial managers. -Assets. The roaming service (type: service); the payment (type: income) -Service usage limit. Contracts between customer and provider (for prepaid contracts -the customer can use as long as the account balance is above zero, for flat-rate contracts -mostly the customer has yearly contracts payable monthly); between HSP and VSP (payment for the services that the customer of the HSP gets -paid per number-of-minutes of calls) -Communication channels. At the time of the contract creation, the communication between the customer and the HSP is either through letters, emails, on-line registration or personally at the customer service. File transfer from VSP to HSP is through encrypted channel between the two. -Infrastructures. HSP database and VSP database systems (type: NRTRDE or other)

Risk assessment

Fraud risk assessment is the process of describing the e-service under assessment, analysing fraud risks and estimating their impacts. The goal of risk analysis is to identify the potential fraud enabling factors using FRPs. To achieve this goal, we have to check all the fraud patterns against the service described above; due to space limitation, we only show this for FRP1 and FRP2. Each fraud pattern targets different entities in the e-service. A strategy of identifying the potential fraud enabling factors is by asking questions whether each FRP enables fraud targeting entities in the given e-service.

To estimate the potential impact to the HSP, we can use a qualitative measurement: high, medium and low. High is when the impact of the fraud is substantial to the HSP that they lose a lot of money beyond the expected expenses. Low is when the impact of fraud is within the customer's contract limit though has an effect on the income of the HSP. Medium is between the scale high and low. For each example fraud identified, we provide high level preventive measures in terms of security requirements.

FRP1 -impersonation. As the target of FRP1 is customers and service providers, and the goal of fraudsters in this fraud pattern is to gain financial benefit or use the service without payment, the question should be: how could customer and HSP possibly be impersonated in the roaming case so that fraudsters gain financial benefit or use the service without payment? Here are some examples:

1. A fraudster could impersonate the customer-service of the HSP to create a flat-rate roaming contract. The fraudster can then generate calls at least for a month until the service is interrupted.

-Impact. High as the service provider is the main target by the fraudster.

-Preventive measures. 1) Strong identity check (e.g. credit check with authorised third party) 2) train the personnel at customer-services about the threats of impersonation; 2. A customer who has a flat-rate roaming contract could be impersonated to clone his SIM-card or to lose his device as it allows a fraudster to commit fraud until the fraud detection system detects it or a customer informs the HSP to stop the service.

-Impact. Medium because the customer is the main target affected by the fraudster, so enforced to pay. In the cases where the customers did not realise the fraud and did not report to the HSP or the fraud detection system didn't detect, the effect might go beyond the customer to affect the income of HSP.

-Preventive measures. 1) Inform the customers who have contracts with the HSP about the common fraud patterns that they might be suspicious 2) advance the fraud detection mechanism to handle SIM cloning and similar impersonation techniques; 3. A fraudster creates a roaming service contract via the HSP's online registration portal with fake identity and credit information.

-Impact. High because the fraudster could resell the service until identified and this directly affects the HSP.

-Preventive measure. The registration portal should certify users and check their credit.

FRP2 -time interval-based misuse. The targets of FRP2 are timedependent activities. So, the question should be: How would time-dependent activities be used to misuse the service? Here are some examples: 1. Because of the time-delay before the VSP sends the CDRs of a customer, fraudster could use the roaming service to call to an expensive destination without being detected or the service being interrupted. This is mainly dangerous if the fraud detection technology is weak at the VSP side.

-Impact. High because 1) there is an unpaid bill by the fraudster and 2) the HSP has to pay the termination fee (for the calls terminated in the VSP network).

-Preventive measures. 1) Limit the amount of time taken to send the CDRs of customers from VHP to HSP 2) Install standardised technologies with both HSP and VSP to prevent modification of CDRs -sometimes this is difficult to implement at VSPs due to lack of jurisdiction). 2. When a fraudster manages to get a flat-rate roaming service, the time-limit to pay the monthly service charge is in danger.

-Impact. High because flat-rate services mostly have no usage limitation which leaves the HSP with the unpaid bill.

-Preventive measure. The HSP should ensure that the customer has not been involved in a fraudulent behaviour (e.g. with the help of credit check organisations).

Discussion

Fraud patterns can successfully be applied not only in the process of FRA, but as well as for producing security requirements and policies. One of the main benefits relies on the fact the each of the fraud patterns targets a specific entity within the e-service model. The description of e-services (e.g. using appropriate modelling languages) thus plays an important role in using them for risk assessment. Since fraud patterns have been identified from five recurring fraud incidents in Telecom e-services, it would be valuable to perform the validation and improvement of those with real practices. Furthermore, the applicability of fraud patterns has only been shown in one domain; other e-services and domains would be interesting for demonstrating the applicability of fraud patterns in FRA of e-services in general. Note, that while performing FRA of e-services allowed us to identify fraud risks, it is also important to put fraud detection approaches in place to gain the full advantages of fraud management.

Conclusion and Future Work

Fraud pattern is a handy way of identifying fraud risks from the perspective of fraudsters. They are an essential part of fraud risk assessment to ease the task of fraud managers to put their preventive measures in place before the fraudsters damage the assets (directly or indirectly). This also increases the security and profitability of e-service providers.

Even though the fraud patterns identified in this paper are from a limited set of existing frauds, they are important to guide future development on fraud patterns. Therefore, to enhance the fraud patterns, we plan to develop a fraud risk assessment tool and apply the fraud patterns for different e-service domains beyond the Telecom domain.

Fig. 1 .

 1 Fig. 1. Domain model for FRA (Fraud Risk Assessment): From left to right -concepts of preventive measures, concepts of fraud and concepts of assets

Fraud case 4 .

 4 Name: Abusing fixed line network credentials during service set-up process of an Internet access service Target: Income of the Telecom service provider Goal: Using service without payment Fraud case 5. Name: Service plan misuse to perform roaming fraud Target: Income of the Telecom service provider Goal: To gain financial benefit

Fig. 2 .

 2 Fig. 2. A semi-structured model for the roaming service case

Table 1 .

 1 Fraud case 3. Stealing credentials to make unauthorised calls from a PBX (Private Branch Exchange) system

	Description	A fraudster is able to retrieve a victim's telephony creden-
		tials from a PBX and sets up a call divert to a destination
		number of his choice for the victim's phone number. The
		fraudster then activates call forwarding to other Telecom
		destinations -mostly located abroad. The fraudster then
		makes the highest number of possible parallel calls through
		the diverted phone number. Calls or forwards triggered by
		the attacker are billed on a per-minute-basis to the victim's
		postpaid account. The destination Telecom passes a share of
		the received call-termination fees to the fraudster, thereby
		providing a payout per minute for incoming calls as incen-
		tive to generate as much incoming traffic as possible to the
		Telecom network.
	Fraud enabler	-Vulnerabilities of the PBX
		-Weak configuration of policies at PBX (e.g. remote access
		to the PBX)
		-The availability of Telecom providers that could pay out
		the income share to the fraud agents who can manage to
		generate a lot of call traffic to customers of those Telecoms.
	Fraud agent	A fraudster who is an outsider
	Fraud method	Call forwarding, social engineering, impersonation
	Fraud threat	Revenue share
	Asset	Credentials and income of the service provider
	Security objective Confidentiality of credentials and misuse protection
	Fraud risk	-A bill with high cost to the customers
		-The customer might not pay the bill.
	Impact	Financial damage and service disruption (unavailability)
	Preventive measure -Implementation of strong PBX policies
		-Create awareness of social engineering to the customer
		-PBX maintenance


David Lorenzi

Jaideep Vaidya

Achyuta Aich

Shamik Sural

Vijayalakshmi Atluri

Joseph Calca

EmojiTCHA: Using Emotion Recognition to Tell Computers and Humans Apart

Keywords: CAPTCHA, emotion recognition, online security, usability

Any successful CAPTCHA design must creatively balance the three competing criteria of usability, scalability, and robustness to achieve widespread deployment in public facing web services. We propose a novel CAPTCHA called EmojiTCHA which utilizes symbolic representations of human emotions in the form of emojis correlated to an image of real humans expressing the same emotion on their face. By leveraging the Project Oxford Emotion API from Microsoft's cognitive services platform, which provides automated detection of human emotion expressions on human faces, we generate a tagged dataset in an automated fashion. Through the use of image warping and distortion techniques, we can significantly increase the robustness of the CAPTCHA against automated attacks, without compromising on usability, as confirmed by our user study.

Introduction

The Completely Automated Public Turing test to tell Computers and Humans Apart (CAPTCHA) was invented by von Ahn et al. [START_REF] Ahn | Captcha: using hard ai problems for security[END_REF] to enable discrimination between humans and computers online. CAPTCHAs are reverse Turing tests administered by computers designed to keep bots from abusing web services and online forms made for human users. CAPTCHAs rely on hard AI problems to provide the challenge question asked to the user (human or bot). This ensures that the challenge question is one that is difficult for a computer to perform with a high degree of success, yet still remains easy for a human to perform quickly Designing effective CAPTCHA challenges has been an ongoing subject of research for more than a decade. Since the widespread introduction of the traditional text based CAPTCHA challenge where the user is asked to enter a string of characters to demonstrate they are human, CAPTCHAs have evolved significantly in style, design and complexity over time as they respond to advancements in attacks from image processing, computer vision and attacker creativity. The greatest challenge in designing a successful CAPTCHA that serves its intended purpose to distinguish between human users and bots is managing the tradeoffs between the competing requirements of usability, scalability and robustness with regard to design.

While text based CAPTCHAs have been the de facto style for CAPTCHA implementations on public websites that need protection from bot abuse, their usage is quickly falling out of favor as more advanced attacks and deep learning models have evolved that can solve the challenge at ever more accurate rates in an automated fashion. As image processing and computer vision algorithms become increasingly more adept at solving traditionally complex problems such as object and text recognition (and even attempts at scene recognition and identifying contextual information contained in an image) [START_REF] Ye | Text detection and recognition in imagery: A survey[END_REF], the standard text based CAPTCHA has increasingly become obsolete.

Newer models for CAPTCHA that are replacing traditional text based challenges rely on strong image identification / object recognition tasks as their primary challenge method. One example of this is Google's new image based version of reCAPTCHA, which asks users to select all images that relate to a particular category (e.g., select all images that contain street signs) from a grid of nine images.

Behavior based models that focus on unique traits and actions of the target user such as websites visited, user agent of browser, geographic location of IP address, browser cookies, etc., to determine a probabilistic score as to whether or not the target user is legitimate are also gaining traction as a new way to distinguish between bot and human. Although these models are not like text/image based CAPTCHAs, they represent a new risk-calculation based approach to this problem. While these image based models are emerging as the preferred alternative to text based CAPTCHAs, they require extensive investments in backend infrastructure and data gathering capabilities (typically at Google scale) to operate in a secure and effective manner. Thus, although the these traditional methods eventually will be broken (such as text vs. deep learning models), for the time being, image based CAPTCHAs can still withstand sophisticated attacks.

In this paper, we demonstrate our design and implementation for a new image based CAPTCHA -one that meets all the three criteria of usability, scalability and robustness. The CAPTCHA is constructed entirely from freely available online tools, open source software and emojis. The central challenge question revolves around the task of asking the user to match an emoji whose expressed emotion corresponds to the face contained in the image(s) displayed. Utilizing the Microsoft Cognitive Services Platform's Project Oxford Emotion API [START_REF]Microsoft cognitive services emotion api[END_REF], human faces and the emotions they are expressing can be detected in an automated fashion from images. This information is subsequently stored and used for preparing a CAPTCHA challenge. However, to prevent the tool itself as well as other image lookup services from being used against the challenge, image warping, noise and distortions are introduced to the image, thus providing security.

Preliminaries

In this section, we cover the core components and tools used to construct the CAPTCHA challenge that allows for the design to be usable, scalable and robust -i.e., providing a reasonable level of security for the online form it is protecting.

Microsoft Project Oxford

Microsoft's Project Oxford is a collection of easy to use artificial intelligence based vision, speech and language APIs that are cloud accessible and can be used in applications by developers. In our CAPTCHA design, we utilize the Face API and the Emotion API. The Emotion API takes an image as an input, and returns the confidence score across a set of emotions for each face in the image, as well as the bounding box for the face, using the Face API. The emotions detected are anger, contempt, disgust, fear, happiness, neutral, sadness, and surprise. These emotions are understood to be cross-culturally and universally communicated with particular facial expressions. Project Oxford's Emotion API is a REST API provided by Microsoft and can be interacted with online. This tool is what provides the critical functionality that delivers the scalability capabilities for our CAPTCHA design. It supports an automated method to accurately and consistently identify and tag emotions within images that contain people's faces. Indeed, we store the output of the Emotion API in a database along with the image and subsequently use it in a challenge served to a user, which asks the user to identify the emotions depicted in the image. The power of this service is that the algorithm can easily scale with demand on the CAPTCHA challenge service, e.g., instances can be run in parallel to produce the requested volume of tagged output as required by the challenge service, i.e., number of unique challenges that need to be served at a particular rate. In order to prevent the use of this and other similar tools against the CAPTCHA, noise is added to the original face image, thereby ensuring failure to identify emotion or faces on images used in challenges. The process of using and applying image noise is described in more detail in the Methodology Section. More details of the Emotion API can be found at https://www.projectoxford.ai/emotion.

Emoji Character Set

The emoji character set is a UNICODE character set designed to convey complex ideas and emotions in the form of small and simple ideograms and/or pictograms. The cross-cultural nature of emojis enhances the usability as it removes specific language and alphabets as a barrier to usability. Our challenge asks a user to match emotions of people in an image with an emoji that conveys the same emotion, providing a solid basis for a simple CAPTCHA challenge task that is easy for humans to understand. Furthermore, since this character set consists of images instead of text, techniques used to provide noise to the images will also work on the emoji characters, which can be scaled based on font size and noised to thwart attackers further, though we do not do so right now. Widespread availability of the emoji UNICODE character sets on smartphone and tablet operating systems ensures high portability on mobile devices that use touchscreens. A list of emoji characters is available at http://apps.timwhitlock.info/emoji/tables/unicode. In our particular implementation for experimentation, we have chosen to use the Twitter emoji set which is open sourced by Twitter for public use. Note that in the current implementation we do not use the UNICODE characters, we simply use the image, since this is easier and does not impact the CAPTCHA itself. UNICODE integration is deferred to future work.

Related Work

Text based CAPTCHA challenges have been under attack by various computer vision and image processing tools since their release via services hosted online. Segmenta-tion attacks, pixel count attacks, filtration attacks and more have all proven effective against certain implementations. Bursztein et al. provide an overview of the strengths and weaknesses of text based CAPTCHA and demonstrate the need to continue to advance the field of CAPTCHA research [START_REF] Bursztein | Text-based captcha strengths and weaknesses[END_REF]. As of 2016, text CAPTCHAs are not being used to a great extent due to deep learning models being able to decipher characters, even distorted and obfuscated ones, at an accuracy of close to 99.8% [START_REF] Goodfellow | Multi-digit number recognition from street view imagery using deep convolutional neural networks[END_REF]. The security field is moving forward with new designs to supersede text based CAPTCHA. For example, Google has developed reCAPTCHA to use images from its image search library and streetview images gathered by its Maps program to provide challenges for the user to solve (categorization task and text entry tasks, respectively) [START_REF] Goodfellow | Multi-digit number recognition from street view imagery using deep convolutional neural networks[END_REF].

While the concept of image CAPTCHAs has been known for a while, their designs have certain inherent properties that make them strong candidates for communicating complex ideas to humans in a quick and efficient manner. Most versions use some form of object/image recognition [START_REF] Rui | Artifacial: Automated reverse turing test using facial features[END_REF][START_REF] Gossweiler | What's up captcha?: A captcha based on image orientation[END_REF] or categorization task [START_REF] Elson | Asirra: A captcha that exploits interest-aligned manual image categorization[END_REF][START_REF] Shirali-Shahreza | Categorizing captcha[END_REF][START_REF] Datta | Imagination: A robust image-based captcha generation system[END_REF] as their primary challenge. The most common shortcoming of existing image based CAPTCHAs, however, is their inability to scale -due to the fact that the images used need to be manually collected, edited, tagged and indexed, be unique, etc. Also, attackers have had some degree of success beating them using image processing and computer vision tools [START_REF] Zhu | Attacks and design of image recognition captchas[END_REF] together with novel machine learning [START_REF] Golle | Machine learning attacks against the asirra captcha[END_REF] techniques to solve the challenges. Three-Dimensional models [START_REF] Ross | Sketcha: A captcha based on line drawings of 3d models[END_REF][START_REF] Woo | 3doc: 3d object captcha[END_REF] and spatial/depth perception [START_REF] Wei | Geocaptcha: A novel personalized captcha using geographic concept to defend against 3rd party human attack[END_REF][START_REF] Nejati | Deepcaptcha: An image captcha based on depth perception[END_REF] are gaining popularity in the image CAPTCHA space as strong use cases for challenges. This style represents an interesting avenue of research as they present challenges that are not singularly straightforward for a machine to solve, as the primary task asked of the user requires multiple subtasks, such as image manipulation by the user or using a mouse instead of a keyboard [START_REF] Chow | Making captchas clickable[END_REF], that must be completed in conjunction to solve the challenge. The Puzzle Only Solvable by Humans (POSH) [START_REF] Daher | Posh: A generalized captcha with security applications[END_REF] is another approach to exploit human interaction for discrimination between humans and computers. A POSH can be generated by a computer, can be consistently answered by a human, and a human answer cannot be efficiently predicted by a computer. However, a POSH does not even have to be verifiable by a computer at all. Usability of CAPTCHAs is also a key issue [START_REF] Yan | Usability of captchas or usability issues in captcha design[END_REF] and new solutions are being devised to provide a fair trade-off between security and usability [START_REF] Fidas | ihip: Towards a user centric individual human interaction proof framework[END_REF].

Although human face image based CAPTCHAs have been studied before [START_REF] Rui | Artifacial: Automated reverse turing test using facial features[END_REF][START_REF] Sim | Face recognition captcha made difficult[END_REF], our work requires multiple subtasks, such as identifying the face in the image, determining their expression, and subsequently matching the appropriate emoji to the correct face. Our key contribution is to develop a scalable and usable image based CAPTCHA that is difficult for a machine to solve.

Methodology

In this section, we discuss the design choices that were made in order to ensure the usability, scalability, and robustness of the proposed CAPTCHA while demonstrating the security it provides from potential attacks. Figure 1 provides an example of the Microsoft Emotion API output. Using a sample face that is smiling (a depiction of the emotion "happiness"), the API provides the coordinates for a faceRectangle, which is a bounding box based on the area in the image Fig. 1: Example output from Emotion API (in pixels) where the Face API detected a human face. It also gives a confidence score for each of the eight emotions that it can detect. For the example image shown in the figure, it is seen that the emotion "happiness" was identified with very high confidence. These two pieces of information provide the ability to generate a CAPTCHA challenge where the user is asked to answer what emotion the face in the presented image is expressing. Note that we could also ask the user to identify the face in the image, though this is correspondingly easy for automated attackers to do. In our implementation, a python script is used to interact with the API online and save the results it returns to a local SQL database, along with the image. Figure 2 depicts an example of the test image served without noise or filters into Google's reverse image search. Note that the results of the search include the image at other dimensions, a keyword guess for what is depicted in the image (e.g. "dental smile"), and a number of visually similar images that all depict "dental smiles", which if one were to ask a person what emotion was being expressed, most likely "happiness" would be the response. Without introducing noise, distortions and filters to the image, an attacker will be able to answer the challenge question without much difficulty. Another straightforward attack would have been to submit it to the same Emotion API application that was used to annotate the challenge image and get the answer. Figure 3 depicts an example chain of filters applied in a specific order to achieve the goal of altering the image enough that reverse image search (RIS), Google image search service (ISS), and computer vision based attacks cannot determine what is depicted in the image. The key is to introduce the minimal amount of distortion such that the tools used to create the challenges are stopped from returning meaningful results. Note that each filter often has multiple parameters that can be adjusted along a range to introduce variability into their output and how they affect the image. For testing, we have determined a series of fixed values for the filters that provide the level of distortion we required to stop the Computer Vision (CV) attack while still maintaining a reasonable level of usability / ease of understanding of the image.

Figure 4 demonstrates how the appropriate level of distorts causes the ISS engines to return results that cannot be meaningfully used to attack the proposed CAPTCHA.

Fig. 2: Useful information can be produced from default image Notice that the addition of the "canvas" filter effect influenced the ISS results towards needlepoint/grid based images -none of which focus on facial features. Also, no keyword is returned as well as no images of other sizes. For all intents and purposes, this distorted image is unique to the search engine, despite the original being indexed and tagged by it. Figure 5 is an example of the Twitter emoji set we used to map to the eight emotions provided by the Microsoft Emotion API. The initial build of our CAPTCHA included all these eight emotions. Microsoft noted that contempt and disgust were experimental emotions, and thus were usually not read as accurately as the other six emotions. After an initial round of user testing, we decided to reduce the number of emotions that could be selected to the five emotions depicted in Figure 6 in an effort to remove confusion and increase usability.

CAPTCHA Challenge Generation

This section focuses on the process flow within the toolchain that is used to generate the CAPTCHA challenges. Figure 7 shows the step by step process used to generate a unique challenge. Specifically, the following process is undertaken:

1. Gather images involving one or more people whose faces are clearly visible expressing one of the following eight emotions: anger, contempt, disgust, fear, hap-Fig. 3: Example of a series of filters applied to the image of Figure 1 piness, neutral, sadness, or surprise. These images can be gathered from anywhere, e.g., using image search engine, downloaded from a camera, etc. They do not need to be manually tagged as the Emotion API will provide that information. 2. Each image is run through the Microsoft Project Oxford Emotion API to detect the number of faces expressing emotions in the image and the facial expressions that fall into one of the eight emotional categories. If at least one clear face is not found or no emotion can be read from the face by the algorithm, the image is discarded.

If at least one clear face expressing one of the eight emotions is found, the image is kept and stored in a database. 3. The output of the Emotion API is recorded in the database along with the stored image. The output from the algorithm includes the face bounding box # (which face in the image the emotion information is from), the emotion expressed by the face, and the level of confidence as a percentage for the emotion expressed by the face. 4. The image is next run through a series of filters and manipulations from GNU Image Manipulation Program (GIMP) [START_REF] Lecarme | The book of GIMP: A complete guide to nearly everything[END_REF] to distort the image for protecting it against reverse image search attacks and computer vision tool based attacks. The number, type, and values for each of the filters used can be varied at random for each individual image produced to make it very difficult for attackers to filter the alterations. This step is important as it prevents using the tools that generate the challenge from being exploited by attackers. The output image is tested against the Emotion API to ensure that no emotion is meaningfully detected. The final altered image, now ready to be used as challenge, is stored in the database with the corresponding information used to create it. Figure 8 shows how filters used in a chain can successively distort an image until it meets the needed security criteria. 5. A set of emojis is selected such that one of them matches the emotion recorded from the Emotion API, and the remaining not matching the emotion, i.e., they would be incorrect/nonexistent responses. 6. The challenge is generated and the user is presented with one or more images of distorted faces and a corresponding set of emojis. The user simply needs to match the correct emoji with the facial expression in the image to complete the challenge. The correctness of the response is evaluated against the ground truth stored in the database.

Fig. 4: No useful information can be extracted from noised image

EmojiTCHA Usability Study

The goal of this section is to evaluate the effectiveness and ease of use of EmojiTCHA. We conducted user trials with 30 participants and asked them to solve as many challenges as they could in 10 minutes. The first run included all eight emotions from the emotion engine. The user was served a challenge at random and asked to match the corresponding emoji to the emotion depicted on the face displayed. Each of the emotion categories had 10 images that were tagged and identified by the Emotion API. The image filters were applied at random until the image no longer returned a match from the Emotion API, thus some images were more distorted than others. ) for the first run with the complete set of eight emotions. The totals on the horizontal axis represent the number of times a challenge with the correct response being the emotion in green was served whereas the totals on the vertical axis represent the number of times that a particular emotion was given as a response for a challenge with the correct answer in green. Figure 10 gives the results for the second run with the reduced set of five emotions as options.

To make it easier to analyze the results we plot the precision and recall results for the different emotions in both runs. Figures 11a and11b give the recall and precision for each emotion when all 8 emotions are used. The recall gives the percentage of images of each emotion correctly identified with that emotion whereas precision gives the percentage of images identified with a particular emotion that do actually have that emotion. The emotions from best performing to worse performing on recall are: neutral (96%), happiness (91%), surprise (87%), anger (76%), fear (67%), sadness (61%), contempt (59%) and disgust (47%). The emotions from best to worse performing on precision are: happiness (83%), contempt (81%), surprise (80%), fear (77%), anger (76%), neutral (73%), sadness (72%) and disgust(45%). Note that disgust was the worst performing emotion in both cases. It was expected that the more abstract of the universal emotions might be more difficult to discern for humans, namely, disgust and contempt. For recall, these emotions performed the worst, scoring significantly lower than the top three emotions. Interestingly, for precision, contempt was the second best emotion recognized, although the scores for the challenges were somewhat lower than the scores for recall, they were much more consistent across emotions, with disgust being the outlier. One aspect is the overlap of emotions that are consistently mistaken for another emotion that may appear similar. For example, we see that disgust was mistaken for anger Fig. 8: Filter based distortion Fig. 9: Confusion Matrix for complete set of emotions 26 times. It is easy to imagine that a disgusted face can take a similar shape to an angry one. We also see this in contempt and anger being mistaken for disgust as well for 26 and 15 times respectively. More user testing will need to be conducted so that any set of emotions served to the user in a challenge will be ones that are not easily mistaken for each other. However, this can also provide a way to make it more difficult for machines -if a competing emotion detection algorithm is ranking a facial expression it is possible that it will score and categorize it differently than the Microsoft Emotion API.

Furthermore, most users were able to solve challenges in a very short duration. Additionally, after solving a few challenges, users are able to significantly increase their subsequent accuracy. To summarize, our study shows that EmojiTCHA in its current form is quite accessible to a wide range of users, with respondents coming from different continents. Figures 12a and12b give the recall and precision when only 5 emotions are used in the challenges. The emotions from best performing to worse performing on recall are: happiness (97%), anger (95%), neutral (94%), surprise (94%), sadness (81%). The emotions from best to worse performing on precision are: surprise (99%), anger (95%), happiness (94%), sadness (92%), neutral (83%). The performance for all scores in both categories increased significantly in limiting the number of choices for the user to select. This shows that using a smaller set of emotions significantly improves usability of the system. Note that this does not significantly compromise on We have also experimented with an alternative design which improves usability, but provides equivalent security to the original version. For example, Figure 13 shows an example where only two emotions are used, but users are asked 3 challenges instead of 1. This keeps the security of random guessing to (1/2) 3 = 1/8 giving us equivalent security to the original single challenge with 8 emotions, but potentially is significantly easier for humans to answer.

Design Limitations and Security Analysis

The images that were chosen for use in the challenges were hand curated to ensure that the desired emotion was demonstrated in the image. Work is currently in progress to tune the image scraper and the Emotion API checker to accept an "emotion" threshold score as a percentage to ensure that there is a high degree of confidence in any particular emotion expressed in a face. Any images that have emotions that register below the threshold can be discarded accordingly. Additional work must be done to determine the optimal "co-emotions" to display with one another to ensure there is minimal mixup by between the emotions displayed on the screen. These will all be addressed in future iterations of the study. Furthermore, in our current implementation, we only use a single emotion from a single face per challenge. Multi-face, multi emotion challenges are currently under development. We are also currently developing ordinality rules for filter application to minimize the number of rounds of filter applications that are required to ensure the security guarantees that CV attacks and RIS attacks will not be successful. The test images used in the experiments for the user study only provide the security guarantee for emotion API attacks -they do not ensure RIS or ISS attacks are not successful, although many of the images do indeed stop these attacks in their current form.

Note that the security of the EmojiTCHA depends on two different factors. First, is the ability of the attacker to successfully de-obfuscate the image, and then use the Emotion API to solve the challenge. Second, is the ability of the attacker to randomly guess the correct response. Regarding the first, the image is obfuscated using lossy filters which result in information loss which cannot be reversed. This provides a layer of security. Furthermore, we ensure that the obfuscated image is robust against reverse image search attacks, which are based on image similarity. Note, that this process can be adjusted as required, if improvements are made in cracking techniques, or in filtering techniques. Regarding the ability to randomly choose the correct response, the current 8-emotion version has a fixed probability of 1/8 for a correct random guess. However, as we have discussed above, reducing the number of emotions improves usability. At the same time, we can ask for a higher number of challenges. Similar to Figure 13, if we ask three challenges, where the number of emotions is increased to three, then the probability reduces to 1/27, which is significantly stronger. We have actually implemented this, and are currently carrying out comparative usability testing. Note that since a fresh CAPTCHA is provided on every refresh, the possibility of a brute force attack is limited as long as sufficient images are included in the CAPTCHA database. Furthermore, since the noise addition is randomly carried out, noise can be added to the same image multiple times, resulting in fresh challenges.

Conclusions and Future Work

In this paper, we have designed a new CAPTCHA that is based on emotion recognition that has the advantage of being scalable and usable while providing good security. In the future, additional work around new form types and challenge questions will be experimented with. For example, testing out multiple emotions in a single image and having a user identify all of the emotions -a multi-answer CAPTCHA. Another example would be asking the user to identify the opposite emotion of that depicted in an image (e.g. pick sad if the image is showing a happy face). Additional work around creating a challenge with an "emotional mix" where a random set of 4 or 5 choices are selected for the challenge from the 8 possible choices. Finally, experimenting with a "not here" answer may be worthwhile to increase the security against a random guess being correct. We plan to work on these extensions in the future.

Fig. 5 :Fig. 6 :Fig. 7 :

 567 Fig. 5: Twitter Emojis used to represent the 8 emotions

Fig. 10 :Fig. 11 :

 1011 Fig. 10: Confusion Matrix for reduced set of emotions

Fig. 12 :Fig. 13 :

 1213 Fig. 12: Results when only 5 emotions are used