** has made at least '''5 calls within the last minute'''

sequential_calls_warning, sequential_calls_critical) VALUES(1, '99', '09:00', '17:00', 'Mon-Fri', 3, 5, 120, 220, 16, 35, 3, 5, 6, 20), \
(1, '99', '17:01', '23:59', 'Mon-Fri', 3, 5, 160, 250, 21, 35, 3, 5, 8, 26), \
(1, '99', '00:00', '08:59', 'Mon-Fri', 3, 4, 80, 160, 10, 20, 3, 4, 5, 15), \
(1, '99', '00:00', '23:59', 'Sat,Sun', 3, 5, 190, 290, 24, 40, 3, 5, 12, 30);

||%block black% 1 || 1 || 99 || 09:00 || 17:00 || Mon-Fri || 3 || 5 || 120 || 220 || 16 || 35 || 3 || 5 || 6 || 20 ||
||%block black% 2 || 1 || 99 || 17:01 || 23:59 || Mon-Fri || 3 || 5 || 160 || 250 || 21 || 35 || 3 || 5 || 8 || 26 ||
||%block black% 3 || 1 || 99 || 00:00 || 08:59 || Mon-Fri || 3 || 4 || 80 || 160 || 10 || 20 || 3 || 4 || 5 || 15 ||
||%block black% 4 || 1 || 99 || 00:00 || 23:59 || Sat,Sun || 3 || 5 || 190 || 290 || 24 || 40 || 3 || 5 || 12 || 30 ||

** makes one call lasting '''between 120 and 219 minutes'''

** makes one call lasting '''at least 220 minutes'''

With the help of the dialog module, fraud_detection is able to closely monitor the following call-related statistics for each ''[user,destination]'' pair:

\\

Validation of a check_fraud() call may be done either with its return code or through the event route. (scripting examples below)

As stated in the Chapter 1 of the [[ http://www.opensips.org/html/docs/modules/2.3.x/fraud_detection.html | documentation ]], the module monitors 5 parameters which are updated every time the '''''check_fraud''''' function is called (i.e each time a call is made). For each set of number prefix and username, unique values of the 5 parameters will be kept and monitored. Each time a value is altered, it will be compared to a threshold value. There are two threshold values for each of the 5 parameters (warning and critical thresholds), thus making a total of 10 values. This threshold values along with a time interval in which they are applicable form a so-called ''rule''. It's the admin's job to provide the ''fraud rules'' to OpenSIPs through the db interface.

!!!! Example script

INSERT INTO fraud_detection(profileid, prefix, start_hour, end_hour, daysoftheweek, cpm_warning, cpm_critical, call_duration_warning, call_duration_critical, \
total_calls_warning, total_calls_critical, concurrent_calls_warning, concurrent_calls_critical, sequential_calls_warning, sequential_calls_critical) \
VALUES(1, '99', '09:00', '17:00', 'Mon-Fri', 3, 5, 120, 220, 16, 35, 3, 5, 6, 20), (1, '99', '17:01', '23:59', 'Mon-Fri', 3, 5, 160, 250, 21, 35, 3, 5, 8, 26), \
(1, '99', '00:00', '08:59', 'Mon-Fri', 3, 4, 80, 160, 10, 20, 3, 4, 5, 15), (1, '99', '00:00', '23:59', 'Sat,Sun', 3, 5, 190, 290, 24, 40, 3, 5, 12, 30);

!!!! Current features

Future directions for the module include adding more compression algorithms and support fore more types of routes.

!!!! Example scenario and DB provisioning

Suppose our OpenSIPs instance is responsible for routing calls to many countries as well as to the ''FarFarAway'' country which has the '''99''' phone prefix. We know that there are a lot of hustlers in this fictional country and if a SIP account was hijacked it could cost our company a huge amount of money by making phoney calls to ''FarFarAway''. So, we are going to look for suspicious patterns in calls to this country. For this we are going to insert four different rules:


The first rule sets the thresholds for all the calls made in the working hours (9-17) in the working days to all the numbers starting with ''99''. Note that we expect anything between 5 and 10 calls during this period to be ''possible'' although not ''probable''. However, more than two calls initiated in a single minute from a single user will raise a warning. Furthermore, we expect that more than one concurrent call from the same user to be a problem. If a user calls a number starting with ''99'' twice in a row (that is without calling any other number between this calls) will also raise an alarm.
The second and the third rules are for time periods outside the working hours, but in the working days. Note that we still expect some calls to be made during this periods (from people who arrive early at the office or from people who stay in late).
The fourth rule is for weekends. Here, almost any call should raise an alarm.
Note, that all the rules have the same '''profile id'''. Basically, this means that they are from the same logical sub-set of rules. Every call of the ''check_fraud'' function will need a profile id.

The following is an example of a fraud detecting profile for destination prefix '''"+99"'''. Note that all rules belong to the same profile: '''1'''.

VALUES(1, '+99', '09:00', '17:00', 'Mon-Fri', 3, 5, 120, 220, 16, 35, 3, 5, 6, 20), (1, '+99', '17:01', '23:59', 'Mon-Fri', 3, 5, 160, 250, 21, 35, 3, 5, 8, 26), \
(1, '+99', '00:00', '08:59', 'Mon-Fri', 3, 4, 80, 160, 10, 20, 3, 4, 5, 15), (1, '+99', '00:00', '23:59', 'Sat,Sun', 3, 5, 190, 290, 24, 40, 3, 5, 12, 30);

||%block black% 1 || 1 || +99 || 09:00 || 17:00 || Mon-Fri || 3 || 5 || 120 || 220 || 16 || 35 || 3 || 5 || 6 || 20 ||
||%block black% 2 || 1 || +99 || 17:01 || 23:59 || Mon-Fri || 3 || 5 || 160 || 250 || 21 || 35 || 3 || 5 || 8 || 26 ||
||%block black% 3 || 1 || +99 || 00:00 || 08:59 || Mon-Fri || 3 || 4 || 80 || 160 || 10 || 20 || 3 || 4 || 5 || 15 ||
||%block black% 4 || 1 || +99 || 00:00 || 23:59 || Sat,Sun || 3 || 5 || 190 || 290 || 24 || 40 || 3 || 5 || 12 || 30 ||

Suppose our OpenSIPs instance is responsible for routing calls to many countries as well as to the ''FarFarAway'' country which has the '''+99''' phone prefix. We know that there are a lot of hustlers in this fictional country and if a SIP account was hijacked it could cost our company a huge amount of money by making phoney calls to ''FarFarAway''. So, we are going to look for suspicious patterns in calls to this country. For this we are going to insert four different rules:


The first rule sets the thresholds for all the calls made in the working hours (9-17) in the working days to all the numbers starting with ''+99''. Note that we expect anything between 5 and 10 calls during this period to be ''possible'' although not ''probable''. However, more than two calls initiated in a single minute from a single user will raise a warning. Furthermore, we expect that more than one concurrent call from the same user to be a problem. If a user calls a number starting with ''+99'' twice in a row (that is without calling any other number between this calls) will also raise an alarm.

INSERT INTO fraud_detection(profileid, prefix, start_hour, end_hour, daysoftheweek, cpm_warning, cpm_critical, call_duration_warning, call_duration_critical,
total_calls_warning, total_calls_critical, concurrent_calls_warning, concurrent_calls_critical, sequential_calls_warning, sequential_calls_critical)
VALUES(1, '+99', '09:00', '17:00', 'Mon-Fri', 3, 5, 120, 220, 16, 35, 3, 5, 6, 20), (1, '+99', '17:01', '23:59', 'Mon-Fri', 3, 5, 160, 250, 21, 35, 3, 5, 8, 26),

INSERT INTO fraud_detection(profileid, prefix, start_hour, end_hour, daysoftheweek, cpm_warning, cpm_critical, call_duration_warning, call_duration_critical, total_calls_warning, total_calls_critical, concurrent_calls_warning, concurrent_calls_critical, sequential_calls_warning, sequential_calls_critical) VALUES(1, '+99', '09:00', '17:00', 'Mon-Fri', 3, 5, 120, 220, 16, 35, 3, 5, 6, 20), (1, '+99', '17:01', '23:59', 'Mon-Fri', 3, 5, 160, 250, 21, 35, 3, 5, 8, 26), (1, '+99', '00:00', '08:59', 'Mon-Fri', 3, 4, 80, 160, 10, 20, 3, 4, 5, 15), (1, '+99', '00:00', '23:59', 'Sat,Sun', 3, 5, 190, 290, 24, 40, 3, 5, 12, 30);

check_fraud("$fU", "$dU", "1");

** makes one call lasting '''between 120 minutes'''

** makes one call lasting '''at least 120 minutes'''

* '''Rule 1''' will obviously match from '''09:00 to 17:00''', '''Monday to Friday'''. It will trigger a %orange%'''fraud warning'''%% event/error each time the same user either:

* The same '''Rule 1''' will trigger a %red%'''fraud critical'''%% event/error each time the same user either:

Additional explanations:

In order to create the '''fraud_detection''' table, first make sure your ''opensipsctlrc'' file contains the desired SQL engine, DB name and credentials:

''Note: some of the above statistics require a user-provisioned time interval to be sampled upon (see 'Table provisioning' below)''

With the help of the dialog module, fraud_detection is able to closely monitor the following call-related statistics for each user:

The module provides a way of {+detecting suspicious calls+} from the same users to the same destinations might would otherwise likely end up costing the affected VoIP account (or the VoIP provider!) considerable amounts of money. This is done by closely {+monitoring a set of call-related parameters+} for each [user,destination] pair, together with sets of provisioned alerting thresholds.

In order to create the '''fraud_detection''' table, first make sure ''opensipsctlrc'' file contains the desired SQL engine, DB name and credentials:

%green%'''fraud_detection table'''

The following is an example of a fraud detecting profile for destination prefix '''"+99"'''. Note that all rules belong to the same profile: 1.

* '''Rule 1''' will obviously match from '''09:00 to 17:00''', '''Monday to Friday'''. It will trigger a %orange%'''fraud warning'''%% each time the same user either:

* The same '''Rule 1''' will trigger a %red%'''fraud critical'''%% each time the same user either:

** attempts to make '''more than 2 simultaneous calls'''

** makes '''more than 5 consecutive calls''' to the same destination

** makes a new call, having made '''at least 15 calls''' in the current interval

* '''Rule 1''' will obviously match from '''09:00 to 17:00''', '''Monday to Friday'''. It will trigger a '''fraud warning''' each time the same user either:

* The same '''Rule 1''' will trigger a '''fraud critical''' each time the same user either:

* Rule 1 will obviously match between 09:00 and 17:00, from Monday to Friday. It will trigger a '''fraud warning''' each time the same user either:
** has made 3 or 4 calls within the last minute
** makes one call lasting at least 120 minutes
** makes a new call, having made at least 15 calls in the current interval
** attempts to make more than 2 simultaneous calls
** makes more than 5 consecutive calls to the same destination

||%block black% 1 || 1 || +99 || 09:00 || 17:00 || Mon-Fri || 3 || 5 || 80 || 220 || 16 || 35 || 3 || 5 || 6 || 20 ||
||%block black% 2 || 1 || +99 || 17:01 || 23:59 || Mon-Fri || 3 || 5 || 140 || 250 || 21 || 35 || 3 || 5 || 8 || 26 ||
||%block black% 3 || 1 || +99 || 00:00 || 08:59 || Mon-Fri || 3 || 4 || 60 || 160 || 10 || 20 || 3 || 4 || 5 || 15 ||
||%block black% 4 || 1 || +99 || 00:00 || 23:59 || Sat,Sun || 3 || 5 || 180 || 290 || 24 || 40 || 3 || 5 || 12 || 30 ||

** has made 2 or 3 calls within the last minute

** makes a new call, having made at least 4 calls in the current interval
** attempts to make more than 1 simultaneous call
** makes more than 1 consecutive calls to the same destination

||%block black% 1 || 1 || +99 || 09:00 || 17:00 || Mon-Fri || 2 || 4 || 120 || 600 || 5 || 10 || 1 || 2 || 2 || 5 ||
||%block black% 2 || 1 || +99 || 17:01 || 23:59 || Mon-Fri || 1 || 2 || 60 || 300 || 1 || 3 || 1 || 1 || 1 || 1 ||
||%block black% 3 || 1 || +99 || 00:00 || 08:59 || Mon-Fri || 1 || 2 || 60 || 300 || 1 || 3 || 1 || 1 || 1 || 1 ||
||%block black% 4 || 1 || +99 || 00:00 || 23:59 || Sat,Sun || 1 || 1 || 30 || 60 || 1 || 1 || 1 || 1 || 1 || 1 ||

** makes 2 calls within the last minute

The following is an example of a fraud detecting profile for destination prefix '''"+99"'''.

With the help of the dialog module, fraud_detection is able to closely monitor the following call-related statistics:

%green%'''fraud_detection table'''

In order to create the '''fraud_detection''' table, edit the ''opensipsctlrc'' file and specify the SQL engine, DB name and credentials:

''Note: some of the above statistics require a user-provisioned time interval to be sampled upon''

In order to create

@]

!!!! Tutorial Overview

The purpose of this tutorial is to help you understand how the %blue%fraud detection%% module works and also how it should be used. After reading
this tutorial you should understand which functions this module provides and also how to use it in order to determine strange patterns of sip calls.

!!!! Current features

As stated in the Chapter 1 of the [[ http://www.opensips.org/html/docs/modules/2.3.x/fraud_detection.html | documentation ]], the module monitors 5 parameters which are updated every time the '''''check_fraud''''' function is called (i.e each time a call is made). For each set of number prefix and username, unique values of the 5 parameters will be kept and monitored. Each time a value is altered, it will be compared to a threshold value. There are two threshold values for each of the 5 parameters (warning and critical thresholds), thus making a total of 10 values. This threshold values along with a time interval in which they are applicable form a so-called ''rule''. It's the admin's job to provide the ''fraud rules'' to OpenSIPs through the db interface.

Future directions for the module include adding more compression algorithms and support fore more types of routes.

!!!! Example scenario and DB provisioning

Suppose our OpenSIPs instance is responsible for routing calls to many countries as well as to the ''FarFarAway'' country which has the '''+99''' phone prefix. We know that there are a lot of hustlers in this fictional country and if a SIP account was hijacked it could cost our company a huge amount of money by making phoney calls to ''FarFarAway''. So, we are going to look for suspicious patterns in calls to this country. For this we are going to insert four different rules:

check_fraud("$fU", "$du", "1");

check_fraud("$fU", "$dU", "1");

Then we set the

The first rule sets the thresholds for all the calls made in the working hours (9-17) in the working days to all the numbers starting with ''+99''. Note that we expect everything anything between 5 and 10 calls during this period to be ''possible'' although not ''probable''. However, more than two calls initiated in a single minute from a single user will raise a warning. Furthermore, we expect that more than one concurrent call from the same user to be a problem. If a user calls to a number starting with ''+99'' twice in a row (that is without calling to any other number between this calls) will also raise an alarm.
The second and the third rules are for time periods outside the working hours, but in the working days. Note, that we still expect some calls to be made during this periods (from people who arrive early at the office or from people who stay in late).

The first rule sets the thresholds for all the calls made in the working hours (9-17) in the working days to all the numbers starting with ''+99''.

Suppose our OpenSIPs instance is responsible for routing calls to many countries as well as to the ''FarFarAway'' country which has the '''+99''' phone prefix. We know that there are a lot of hustlers in this fictional country and if a SIP account was hijacked it could cost our company a huge amount of money by making phoney calls to ''FarFarAway''. So, we are going to look for suspicious patterns in calls to this country. For this we are going to insert two different rules:

||[@c22
@]||

||%block black% 2 || 1 || +99 || 17:01 || 23:59 || Mon-Fri || 1 || 2 || 60 || 300 || 1 || 3 || 1 || 1 || 1 || 1 ||

||%block black% [@c21
@]||[@c22

|| '''ruleid''' || '''profileid''' || '''prefix''' || '''start_hour''' || '''end_hour''' || '''daysoftheweek''' || '''cpm_warning''' || '''cpm_critical''' || '''call_duration_warning''' || '''call_duration_critical''' || '''total_calls_warning''' || '''total_calls_critical''' || '''concurrent_calls_warning''' || '''concurrent_calls_critical''' || '''sequential_calls_warning''' || '''sequential_calls_critical''' ||

||%block black% 1 || 1 ||

||%block black% [@
c1
@]||[@c2
@]||

|| '''With Script Helper''' || '''Classic Script''' ||

'''ruleid''' || '''profileid''' || '''prefix''' || '''start_hour''' || '''end_hour''' || '''daysoftheweek''' || '''cpm_warning''' || '''cpm_critical''' || '''call_duration_warning''' || '''call_duration_critical''' || '''total_calls_warning''' || '''total_calls_critical''' || '''concurrent_calls_warning''' || '''concurrent_calls_critical''' || '''sequential_calls_warning''' || '''sequential_calls_critical''' ||
||%block black% [@c1

|| '''With Script Helper''' || '''Classic Script''' ||

Suppose our OpenSIPs instance is responsible for routing calls to many countries as well as to the ''FarFarAway'' country which has the '''+99''' phone prefix. We know that there are a lot of hustlers in this fictional country and if a SIP account was hijacked it could cost our company a huge amount of money by making phoney calls to ''FarFarAway''. So, we are going to look for suspicious patterns in calls to this country.

Suppose our OpenSIPs instance is responsible for routing calls to many countries as well as to the ''FarFarAway'' country which has the '''+99''' phone prefix. We know that there are a lot of hustlers in this fictional country and if a SIP account was hijacked it could cost our company a huge amount of money by making phoney calls to ''FarFarAway''

Future directions for the module include adding more compression algorithms and support fore more types of routes.

As stated in the Chapter 1 of the [[ http://www.opensips.org/html/docs/modules/2.3.x/fraud_detection.html | documentation ]], the module monitors 5 parameters which are updated every time the '''''check_fraud''''' function is called (i.e each time a call is made). For each set of number prefix and username, unique values of the 5 parameters will be kept and monitored. Each time a value is altered, it will be compared to threshold value. There are two threshold values for each of the 5 parameters, thus making a total of 10 values. This thresholds along with a time interval in which they area applicable form a so-called ''rule''. It's the admin's job to provide the ''fraud rules'' to OpenSIPs through the db interface.

As stated in the Chapter 1 of the [[ http://www.opensips.org/html/docs/modules/2.3.x/fraud_detection.html | documentation ]], the module monitors 5 parameters which are updated every time the '''''check_fraud''''' function is called (i.e each time a call is made). For each set of number prefix and username, unique values of the 5 parameters will be kept and monitored. However, it's the admin's duty to define

this tutorial you should understand which functions this module provides and also how to use it in order to determine strange patterns of sip calls.

----

Hello World