According to other exemplary implementations, core devices 122 may include additional, different, and/or fewer network devices than those described. For example, core devices 122 may include a non-standard or a proprietary network device, and/or another type of network device that may be well-known but not particularly mentioned herein. Core devices 122 may also include a network device that provides a multi-RAT functionality (e.g., 4G and 5G, 5G and 5.5G, 5G and 6G, etc.), such as an SMF with PGW control plane functionality (e.g., SMF+PGW-C), a UPF with PGW user plane functionality (e.g., UPF+PGW-U), and/or other combined nodes (e.g., an HSS with a UDM and/or UDR, an MME with an AMF, etc.). Also, core devices 122 may include a split core device 122. For example, core devices 122 may include a session management (SM) PCF, an access management (AM) PCF, a user equipment (UE) PCF, and/or another type of split architecture associated with another core device 122, as described herein.

According to an exemplary embodiment, at least some of core devices 122 may include logic of the multifaceted detection of fraudulent data usage service, as described herein. For example, core device 122 may transmit and receive messages pertaining to the multifaceted detection of fraudulent data usage service, as described herein. For example, core device 122 may provide data pertaining to end device 130, which may be subject to the multifaceted detection of fraudulent data usage service, to multifaceted fraud detection device 125. Additionally, for example, core device 122 may obtain data pertaining to end device 130 based on a request from multifaceted fraud detection device 125. According to further examples, core device 122 may perform evaluation, examination, and/or analysis of the data for identifying fraudulent activity/data usage.

Probe 124 may include a device that captures data subject to examination. For example, probe 124 may tap, collect, read, and/or copy data transmitted, such as an optical traffic access point (TAP) or another type of network TAP and/or provide deep packet inspection (DPI), packet sniffing, or the like. According to an exemplary embodiment, probe 124 may perform an examination of the data in accordance with one or multiple types of examinations, as described herein. According to another exemplary embodiment, probe 124 may not perform an examination of the data but provide the data to another device (e.g., multifaceted fraud detection device 125 and/or another type of network device (e.g., access device 107, core device 122, external device 117, etc.)). According to some exemplary embodiments, access device 107, core device 122, and/or external device 117, for example, may include probe 124. According to other examples, a cell site route (CSR) may include probe 124. According to yet another example, probe 124 may be included in other types of network devices/systems, such as a traffic aggregation point (TAP), a service aggregation point (SAP), or other suitable nodes in the network. According to an exemplary embodiment, as illustrated, a communication link may include probe 124 (e.g., an intermediary device) that provides the multifaceted detection of fraudulent data usage service.

Multifaceted fraud detection device 125 may include a network device that includes logic of the multifaceted detection of fraudulent data usage service, as described herein. Although multifaceted fraud detection device 125 is depicted outside of access network 105, external network 115, and core network 120, such an illustration is exemplary. According to other exemplary implementations, multifaceted fraud detection device 125 may reside in one or multiple networks depicted and described herein. Additionally, multifaceted fraud detection device 125 may be implemented in a centralized, distributed, and/or another type of network and/or computing architecture as a network device or system, as described herein.

According to an exemplary embodiment, multifaceted fraud detection device 125 may include logic that provides fraudulent detection to multiple facets of network usage including end device identifier analysis, end device registration analysis, traffic analysis, and end device examination analysis, as described herein. According to an exemplary embodiment, multifaceted fraud detection device 125 may facilitate and/or coordinate a fraud detection procedure among one or multiple network devices, such as access device 107, external device 117, and/or core device 122 in relation to end device 130. Additionally, or alternatively, multifaceted fraud detection device 125 may facilitate and/or coordinate a fraud detection procedure in relation to an application service layer session, a quality of service (QoS) flow, a packet data unit (PDU) session, a PDN session, a bearer, a network slice, and/or a connection (e.g., end-to-end, a segment or portion of an end-to-end connection, etc.), a network procedure (e.g., registration, attachment, handover, session establishment, session teardown, local breakout, authentication, etc.), a message (e.g., control plane message, user plane message, user plane traffic, etc.), and/or another type of element associated with network usage or activity attributable to end device 130, a user of end device 130, or both, as described herein.

According to an exemplary embodiment, multifaceted fraud detection device 125 may calculate one or multiple scores associated with fraudulent detection. Multifaceted fraud detection device 125 may compare the score or scores to one or multiple threshold values. Multifaceted fraud detection device 125 may determine whether fraudulent activity has occurred based on a result of the comparison. According to other exemplary embodiments, multifaceted fraud detection device 125 may not calculate a score nor compare to a threshold value to determine whether fraudulent activity has occurred. Rather, multifaceted fraud detection device 125 may make this determination based on a result of the examination associated with a fraudulent detection procedure.

According to an exemplary embodiment, multifaceted fraud detection device 125 may invoke a remedial procedure when fraudulent activity has been determined. For example, multifaceted fraud detection device 125 may communicate with another network device (e.g., core device 122, access device 107, etc.) to initiate disconnection with end device 130 and/or prevent prospective network usage by end device 130.

End device 130 includes a device that may have communication capabilities (e.g., wireless, wired, optical, etc.). End device 130 may or may not have computational capabilities. End device 130 may be implemented as a mobile device, a portable device, a stationary device (e.g., a non-mobile device and/or a non-portable device), a device operated by a user, or a device not operated by a user. For example, end device 130 may be implemented as a smartphone, a mobile phone, a personal digital assistant, a tablet, a netbook, a wearable device (e.g., a watch, glasses, etc.), a computer, a gaming device, a music device, an IoT device, a drone, a smart device, a fixed wireless device, a router, a sensor, a Hum device, or other type of wireless device (e.g., other type of UE). End device 130 may include multiple end devices 130 when tethering is used. End device 130 may be configured to execute various types of software (e.g., applications, programs, etc.). The number and the types of software may vary among end devices 130. End device 130 may include “edge-aware” and/or “edge-unaware” application service clients. For purposes of description, end device 130 is not considered a network device.

According to an exemplary embodiment, end device 130 may include logic of the multifaceted detection of fraudulent data usage service, as described herein. For example, end device 130 may transmit and receive messages pertaining to the multifaceted detection of fraudulent data usage service, as described herein. For example, end device 130 may provide data pertaining to end device 130, which may be subject to the multifaceted detection of fraudulent data usage service, to multifaceted fraud detection device 125. Additionally, for example, end device 130 may obtain data pertaining to end device 130 based on a request from multifaceted fraud detection device 125 and/or another network device (e.g., access device 107, core device 122, external device 117, or another type of network device/system, as described herein). According to further examples, end device 130 may perform evaluation, examination, and/or analysis of the data for identifying fraudulent activity/data usage.

FIG. 2 is a diagram illustrating another exemplary environment 200 in which an exemplary embodiment of the multifaceted detection of fraudulent data usage service may be implemented. As illustrated, environment 200 may include a network 205, a network device 210, and a storage device 215. Environment 200 may further include probe 124, multifaceted fraud detection device 125, and end device 130, which have already been described. Similar to the description of environment 100, the number, type, and arrangement of network devices, end device 130, communication links, and so forth, may be different in other embodiments.

Network 205 may include access network 105, core network 120, external network 115, and/or other types of networks, as described herein. Network device 210 may include access device 107, external device 117, core device 122, probe 124, and/or another type of network device/system (e.g., a CSR, a TAP, a SAP, etc.), as described herein. Storage device 215 may include a network device that stores information that may be used by the multifaceted detection of fraudulent data usage service. For example, storage device 215 may store information that correlates and/or pertains to end devices 130. By way of further example, storage device 215 may store end device identifiers associated with end devices 130, users, and/or subscribers relating to a network service provider and/or network service. Storage device 215 may correlate the end device identifiers to various types of information, such as subscriber plans, end device information (e.g., device manufacturer, model number, software version, operating system (OS), network ports used, or the like), applications (e.g., hostnames, fully qualified domain names (FQDNs), access point names (APNs), etc.) used by a specific manufacturer or device type, and/or another type of instance of data that may indicate a characteristic of end device 130. According to various exemplary embodiments, network device 205 and/or multifaceted fraud detection device 125 may have access and query storage device 215 so as to perform an examination procedure.

FIGS. 3A-3C are diagrams illustrating an exemplary process 300 of an exemplary embodiment of the multifaceted detection of fraudulent data usage service. Although steps, procedures, functions, or the like of process 300 are described and/or illustrated as being performed by a particular network device, according to other exemplary embodiments, one or more of the steps, procedures, functions, or the like of process 300 may be performed by a different network device. For example, a step, a procedure, a function, or the like of process 300 described as being performed by multifaceted fraud detection device 125, according to other exemplary embodiments, access device 107, external device 117, core device 122, or probe 124 may perform such step, procedure, function, or the like, in whole or in part. Similarly, a step, a procedure, a function, or the like of process 300 described as being performed by access device 107, external device 117, core device 122, or probe 124, for example, according to other exemplary embodiments, multifaceted fraud detection device 125 may perform such step, procedure, function, or the like, in whole or in part.

As illustrated, referring to FIG. 3A, in step 305, multifaceted fraud detection device 125 may select end device 130 to be subject to the multifaceted detection of fraudulent data usage service. According to some exemplary implementations, multifaceted fraud detection device 125 may make this selection based on billing and/or charging records and/or data usage that is exceedingly high. Although not illustrated, according to some exemplary implementations, multifaceted fraud detection device 125 may receive billing, charging, and/or data usage information from one or more core devices, such as a charging function (CHF), a PCEF, an online charging function (OCF), a CS, an HSS, a UDR, or another type of network device. According to other exemplary implementations, multifaceted fraud detection device 125 may make the selection based on other types of criteria. According to other exemplary embodiments, the one or more core devices and/or a proprietary network device may make such a selection.

In step 310, multifaceted fraud detection device 125 may notify network device 210 of the selection via a notification 312. Notification 312 may include the end device identifier and data indicating that end device 130 is subject to examination procedures of the multifaceted detection of fraudulent data usage service, as described herein. According to some exemplary embodiments, multifaceted fraud detection device 125 may identify an end device identifier (e.g., IMEI, etc.) of the selected end device 130 based on information stored at storage device 215. According to various exemplary scenarios, the selection and notification may be performed while end device 130 is active or connected to network 205, or when end device 130 may not be connected to network 205 (e.g., prospectively).

Referring to FIG. 3B, according to this exemplary scenario, assume end device 130 establishes a connection 315 with network 205. During the connection establishment procedure, an end device identifier examination procedure may be performed. For example, control plane signaling, such as a radio resource control (RRC) message and/or control plane message to the core network (e.g., associated with an authentication procedure, a registration procedure, etc.), an end device identifier of end device 130 may be obtained by network device 210 (e.g., access device 107, core device 122, probe 124, etc.). The end device identifier may be an IMEI or an IMEISV, for example. As illustrated, network device 210 may transmit data 320 to multifaceted fraud detection device 125. Data 320 may include the end device identifier. Data 320 may also include data that identifies the type of examination procedure for which data 320 is to be used. In response to receiving data 320, multifaceted fraud detection device 125 may perform an examination 325 using data 320. For example, multifaceted fraud detection device 125 may query 330 storage device 215 and analyze the TAC of the IMEI or the IMEISV using end device information obtained from query 330. Based on a comparison of the TAC to the end device information, multifaceted fraud detection device 125 may determine whether end device 130 is an authorized device or not. For example, multifaceted fraud detection device 125 may determine whether end device 130 is a certified, compatible, or network operator device versus a third party device (e.g., an LTE/5G router or another type of end device 130). Additionally, or alternatively, multifaceted fraud detection device 125 may determine that the type of end device 130 indicated by the TAC does not match the subscription plan under which end device 130 is billed. For example, a mobile hotspot device may be on a smartphone plan.

Referring again to FIG. 3B, multifaceted fraud detection device 125 may perform an end device registration examination procedure. For example, as a part of initial registration with network 205 (e.g., including core network 120), network 205 may request a capability report from end device 130. Alternatively, end device 130 may provide (e.g., without a request from network 205) a capability report to network 205. As an example, the capability report may be implemented as a network capability and radio capability report. The network capability report may include information indicating supported algorithms for encryption and integrity, and the radio capability report may include information indicating UE capability band combinations and UE band capability (e.g., EUTRA capability, NR capability, etc.).

Similar to that described, network device 210 may transmit data 320 to multifaceted fraud detection device 125. Data 320 may include the capability report. Data 320 may include the end device identifier. Data 320 may also include data that identifies the type of examination procedure for which data 320 is to be used. In response to receiving data 320, multifaceted fraud detection device 125 may perform an examination 325 using data 320. For example, multifaceted fraud detection device 125 may query 330 storage device 215 and analyze the TAC of the IMEI or the IMEISV using end device information obtained from query 330. For example, based on the model and/or the model and SV, end device 130 should have a correlated capability (e.g., based on a TAC range). Based on a comparison of the TAC to the end device information, multifaceted fraud detection device 125 may determine whether the capabilities match. As an example, when the capabilities do not match, end device 130 may have had its end device identifier modified and be considered an unauthorized device. Based on this determination, multifaceted fraud detection device 125 may deem the network usage of end device 130 as fraudulent. Otherwise, if the capabilities do match, multifaceted fraud detection device 125 may determine that end device 130 may be an authorized device according to this particular examination procedure.

Multifaceted fraud detection device 125 may perform an end device registration examination procedure that relates to continued registration with an application service layer network. For example, an IMS network, a MEC network, or another type of application service layer network may be configured to require that end device 130 initially registers and re-registers according to a prescribed time or schedule. As an example, the IMS network may require that end device 130 registers and re-registers with the IMS network every two hours (or another configurable time period) while end device 130 remains connected to the IMS network. For example, this requirement may be applicable to end device 130 due to its capabilities (e.g., voice capability, short messaging service (SMS) capability, etc.). When end device 130 fails to satisfy this requirement (e.g., fails to initially register and/or fails to re-register according to a prescribed time period or schedule), for example, external device 117 may transmit data 320 to multifaceted fraud detection device 125. Data 320 may include the end device identifier and data indicating the failure of end device 130 to properly register with the application service layer network. Multifaceted fraud detection device 125 may query 330 storage device 215, determine the capabilities of end device 130 associated with application service layer network, and determine whether end device 130 is an authorized device or not. Additionally, if end device 130 registers with an application service layer network, as a part of the registration procedure, a message from end device 130 may include a user-agent field. The user-agent field may include end device information (e.g., manufacturer, model number, software version, and/or other characteristic information), which may be compared to end device information stored at storage device 215. Based on a comparison, multifaceted fraud detection device 125 may determine whether end device 130 is an authorized device or not.

Referring to FIG. 3B yet again, multifaceted fraud detection device 120 may perform a user traffic examination procedure. For example, in relation to the fraudulent activity of tethering masking, a fraudulent data user may manipulate standard time-to-live (TTL) parameters of a packet in order to make data usage of a tethered device appear to be from or attributable to end device 130 and thus bypass tethering data usage limits. As previously described, a user-agent field may be included in messages to application service layer network device (e.g., external device 117). As an example, a user-agent field of an HTTP packet may include end device information. Network device 210 may provide data 320, which includes the user-agent header information. Multifaceted fraud detection device 125 may compare this information to end device information and determine whether the end device identifier has been modified. In this way, the user-agent information stemming from traffic of a tethered device may be used to detect and prove data usage fraud.

According to another examination of user traffic, multifaceted fraud detection device 125 may identify application layer services used by specific end device manufacturers and/or device types (e.g., mobile phone, tablet, router, tethered device, etc.). According to an exemplary embodiment, storage device 215 may store end device profile information, which may correlate end device information to application layer service information. For example, the application layer service information may include a hostname, an APN, an IP address, a DNS query, or the like relating to an application service. According to exemplary implementation, the end device profile information may be generated based on user traffic monitoring. For example, fraudulent data usage attributable to torrenting may enable the generation of an end device profile. According to another example, the monitoring of user traffic among multiple end devices 130 may enable the generation of multiple end device profile associated with a diverse array of end devices 130.

Accordingly, network device 210 may transmit data 320, which may include application layer service information, to multifaceted fraud detection device 125. Based on the end device profile information obtained via query 330, multifaceted fraud detection device 125 may determine whether fraudulent activity has occurred. For example, if there is frequent user traffic from an application related service (e.g., the MICROSOFT WINDOWS® update service), the user may be masking a tethered device and bypassing network tethering data usage limits. By way of further example, the end device identifier of end device 130, such as smartphone of a particular model and/or manufacturer, would not be communicating with a MICROSOFT WINDOWS® update server.

According to yet another examination of user traffic, fraudulent users may reset their network connection by forcing network attachments multiple times per hour (or other time period) to prevent user traffic capture in real-time. In comparison, normal users may not reset network connectivity frequently. Due to the frequent connection and disconnection procedure of end device 130, end device 130 may obtain a new IP address each cycle and consequently this creates a difficulty in monitoring its user traffic, as mentioned above. Network device 210 may detect this unusual behavior or log each attachment/detachment procedure associated with end device 130 and transmit data 320 indicating such occurrence or multiple occurrences to multifaceted fraud detection device 125. In response to receiving data 320 and as a part of performing examination 325, multifaceted fraud detection device 125 may determine or confirm whether end device 130 has exceeded or satisfied a threshold value of a number of attachments/detachments within a time period. If so, multifaceted fraud detection device 125 may invoke a static IP address assignment procedure. For example, the static IP address assignment procedure may enable network device 205 (e.g., a PGW, a UPF) to assign end device 130 a static IP address such that the user traffic of end device 130 may be monitored and examined according to one or more of the examinations described herein. According to some exemplary embodiments, multifaceted fraud detection device 125 may host a pool of static IP addresses, which may be provided to network device 205. Additionally, or alternatively, multifaceted fraud detection device 125 may instruct network device 205 to assign a static IP address (or the selected static IP address by multifaceted fraud detection device 125) to end device 130. According to some exemplary embodiments, multifaceted fraud detection device 125 or via a network provisioning system configure access device 107, core device 122 (e.g., other than PGW or UPF), external device 117, etc., with an indication that end device 130 having the static IP address is subject to the multifaceted detection of fraudulent data usage service.

Referring to FIG. 3B again, multifaceted fraud detection device 125 may perform an end device examination procedure. According to an exemplary embodiment of the end device examination procedure, end device 130 may be queried to provide data indicating the OS of end device 130. As an example, either through control plane or user plane messaging, network device 210 or multifaceted fraud detection device 125 via network device 210 may transmit a packet to end device 130. By utilizing a stack (e.g., TCP/IP stack) of end device 130, end device 130 may transmit a response, which may be analyzed to determine the OS executing on end device 130. Multifaceted fraud detection device 125 may receive data 320, which may include the response information (e.g., OS). In response, based on the end device identifier of end device 130, multifaceted fraud detection device 125 may query 330 storage device 215 to obtain the OS that may be indicated by the TAC of the end device identifier stored in storage device 215. Multifaceted fraud detection device 125 may determine whether the OS matches. As an example, if an IPHONE® is queried and replies that it is running LINUX® OS instead of IOS®, multifaceted fraud detection device 125 may determine an end device identifier modification and an unauthorized device.

According to another implementation of end device examination, active ports used by end device 130 for communicating user traffic, may be compared to common or typical ports used for application layer services, such as Secure Shell (SSH), torrents, and server hosting. As an example, network device 205 may scan port usage associated with user traffic, provide this information to multifaceted fraud detection device 125 (e.g., data 320), and multifaceted fraud detection device 125 may query 330 storage device 215, and compare data 320 to port number and application service information stored by storage device 215. Based on a result of the comparison, multifaceted fraud detection device 125 may determine whether fraudulent data usage is occurring or not.

According to yet another implementation of end device examination, end device 130 may include (carrier-level) diagnostic, monitoring, and/or a similar type of system software built in. The system software may collect or derive data that may indicate the types of applications, features, and/or settings on end device 130. The collected or derived data may be provided to multifaceted fraud detection device 125 as data 320. In response multifaceted fraud detection device 125 may determine whether end device 130 may determine whether fraudulent activity may occur or has occurred. For example, if end device 130 hosts an application used for masking tethered device data usage and has used the application, multifaceted fraud detection device 125 may determine that fraudulent data usage has occurred.

Referring to FIG. 3C, according to an exemplary embodiment of process 300, in step 340, multifaceted fraud detection device 125 may perform scoring. For example, multifaceted fraud detection device 125 may calculate a scoring value based on the fraud detection examinations performed. According to some exemplary implementations, multifaceted fraud detection device 125 may calculate a scoring value for each examination (e.g., end device identifier examination, OS detection examination, etc.) or each category of examination (e.g., user traffic examination, end device examination, etc.). Additionally, or alternatively, multifaceted fraud detection device 125 may calculate an aggregate scoring value indicative of the results of the examinations performed. The aggregated scoring value may be calculated based on a summation, averaging, and/or another statistical method using scoring values associated with each examination or each category of examination. According to some exemplary embodiments, a scoring value may be weighted. For example, a weighted value may be based on the amount of data and/or the number of occurrences examined. In this regard, the weighted value may be the same or not the same among different examinations.

In step 345, multifaceted fraud detection device 125 may compare the aggregate scoring value to a threshold value. When the threshold value is satisfied, multifaceted fraud detection device 125 may determine that fraudulent activity (e.g., fraudulent data usage, etc.) has occurred. In step 350, multifaceted fraud detection device 125 may invoke a remedial procedure. For example, multifaceted fraud detection device 125 may transmit a message 355 to network device 210. Message 355 may include the end device identifier of end device 130 and data indicating that fraudulent activity has been detected. The remedial procedure may prevent current network usage and/or prospective network usage by end device 130. When the threshold value is not satisfied, multifaceted fraud detection device 125 may log the examinations and result, for example.

According to other exemplary embodiments and scenarios, process 300 may include additional operations, fewer operations, and/or different operations than those illustrated and described.

FIG. 4 is a diagram illustrating exemplary components of a device 400 that may be included in one or more of the devices described herein. For example, device 400 may correspond to access device 107, external device 117, core device 122, probe 124, multifaceted fraud detection device 125, end device 130, network device 205, and/or other types of devices, as described herein. As illustrated in FIG. 4, device 400 includes a bus 405, a processor 410, a memory/storage 415 that stores software 420, a communication interface 425, an input 430, and an output 435. According to other embodiments, device 400 may include fewer components, additional components, different components, and/or a different arrangement of components than those illustrated in FIG. 4 and described herein.

Bus 405 includes a path that permits communication among the components of device 400. For example, bus 405 may include a system bus, an address bus, a data bus, and/or a control bus. Bus 405 may also include bus drivers, bus arbiters, bus interfaces, clocks, and so forth.

Processor 410 includes one or multiple processors, microprocessors, data processors, co-processors, graphics processing units (GPUs), application specific integrated circuits (ASICs), controllers, programmable logic devices, chipsets, field-programmable gate arrays (FPGAs), application specific instruction-set processors (ASIPs), system-on-chips (SoCs), central processing units (CPUs) (e.g., one or multiple cores), microcontrollers, neural processing unit (NPUs), and/or some other type of component that interprets and/or executes instructions and/or data. Processor 410 may be implemented as hardware (e.g., a microprocessor, etc.), a combination of hardware and software (e.g., a SoC, an ASIC, etc.), may include one or multiple memories (e.g., cache, etc.), etc.

Processor 410 may control the overall operation, or a portion of operation(s) performed by device 400. Processor 410 may perform one or multiple operations based on an operating system and/or various applications or computer programs (e.g., software 420). Processor 410 may access instructions from memory/storage 415, from other components of device 400, and/or from a source external to device 400 (e.g., a network, another device, etc.). Processor 410 may perform an operation and/or a process based on various techniques including, for example, multithreading, parallel processing, pipelining, interleaving, learning, model-based, etc.

Memory/storage 415 includes one or multiple memories and/or one or multiple other types of storage mediums. For example, memory/storage 415 may include one or multiple types of memories, such as, a random access memory (RAM), a dynamic RAM (DRAM), a static RAM (SRAM), a cache, a read only memory (ROM), a programmable ROM (PROM), an erasable PROM (EPROM), an electrically EPROM (EEPROM), a single in-line memory module (SIMM), a dual in-line memory module (DIMM), a flash memory (e.g., 2D, 3D, NOR, NAND, etc.), a solid state memory, and/or some other type of memory. Memory/storage 415 may include a hard disk (e.g., a magnetic disk, an optical disk, a magneto-optic disk, a solid-state component, etc.), a Micro-Electromechanical System (MEMS)-based storage medium, and/or a nanotechnology-based storage medium.

Memory/storage 415 may be external to and/or removable from device 400, such as, for example, a Universal Serial Bus (USB) memory stick, a dongle, a hard disk, mass storage, off-line storage, or some other type of storing medium. Memory/storage 415 may store data, software, and/or instructions related to the operation of device 400.

Software 420 includes an application or a program that provides a function and/or a process. As an example, with reference to multifaceted fraud detection device 125, software 420 may include an application that, when executed by processor 410, provides a function and/or a process of multifaceted detection of fraudulent data usage service, as described herein. Additionally, for example, with reference to access device 107, core device 122, and/or external device 117, software 420 may include an application that, when executed by processor 410, provides a function and/or a process of multifaceted detection of fraudulent data usage service, as described herein. Software 420 may also include firmware, middleware, microcode, hardware description language (HDL), and/or another form of instruction. Software 420 may also be virtualized. Software 420 may further include an operating system (OS) (e.g., Windows, Linux, Android, proprietary, etc.).

Communication interface 425 permits device 400 to communicate with other devices, networks, systems, and/or the like. Communication interface 425 includes one or multiple wireless interfaces, optical interfaces, and/or wired interfaces. For example, communication interface 425 may include one or multiple transmitters and receivers, or transceivers. Communication interface 425 may operate according to a protocol stack and a communication standard.

Input 430 permits an input into device 400. For example, input 430 may include a keyboard, a mouse, a display, a touchscreen, a touchless screen, a button, a switch, an input port, a joystick, speech recognition logic, and/or some other type of visual, auditory, tactile, affective, olfactory, etc., input component. Output 435 permits an output from device 400. For example, output 435 may include a speaker, a display, a touchscreen, a touchless screen, a light, an output port, and/or some other type of visual, auditory, tactile, etc., output component.

As previously described, a network device may be implemented according to various computing architectures (e.g., in a cloud, etc.) and according to various network architectures (e.g., a virtualized function, PaaS, etc.). Device 400 may be implemented in the same manner. For example, device 400 may be instantiated, created, deleted, or some other operational state during its life cycle (e.g., refreshed, paused, suspended, rebooting, or another type of state or status), using well-known virtualization technologies. For example, access device 107, core device 122, external device 117, and/or another type of network device or end device 130, as described herein, may be a virtualized device.

Device 400 may perform a process and/or a function, as described herein, in response to processor 410 executing software 420 stored by memory/storage 415. By way of example, instructions may be read into memory/storage 415 from another memory/storage