Anti-fraud

Anti-fraud rules are in main menu Alerts / Anti fraud. We are continuously adding more rules to combat fraud / attacks and as of now you can use following rules. Each fraud alert also implements custom script which can be used to automatically run firewall rule or any action you like besides the standard email alert. Each alert is also archived in Sent alerts.

List of fraud / watchdog alerts

• Realtime concurrent calls
• SIP REGISTER flood / attack
• SIP PACKETS flood / attack
• change cdr country
• change register country
• country/continent destination
• Billing#Watchdog

Some fraud rules have common configuration

• Enable hyperlinks - in the email alert the title will be html hyperlink which transfer you to rule definition
• IP include/exclude - you can exclude some list of IP addresses or IP networks (ex.: 10.0.0.0/8) or you can use IP groups and select it.
• suppress repeating alerts - to prevent spamming you from repeating alerts you can limit that the rule will sent alert only once per X hours.
• Numbers include/exclude - by default there is no tel. number filter and you can exclude some source number / prefixes. For example you want to have one general rule to be alerted if any IP will have more than 10 concurrent calls expect for some customer with some numbers.

• external script - path to the script on the server which will be executed.

#!/usr/bin/php
<?php
#echo "DECODE PARENT INFO\n";
#print_r(json_decode($argv[2]));
#echo "DECODE RULES INFO\n";
$triggedRules = json_decode($argv[4]);
#number of tresspass of address
$IPtriggers=array();
foreach ( $triggedRules as $rule ) {                            //for each triggererd rule
#       $keyIP = $rule->alert_info->ip;                         //get 'source ip which triggered rule' will used as key.
        $when = $rule->at;                                      //get 'when this rule triggered?'
#       $type = $rule->alert_info->local_international;         //get type enum 'was "local" or "international" or "local & international" limits exceeded?'
#       if (!isset ( $rule->alert_info->timeperiod_name )) {    //get name of time-period rule which was triggered, if name isn't set its main parent rule.
#               $name = "Parent rule";
#       } else {
#               $name = $rule->alert_info->timeperiod_name;
#       }
#       print "\n\nName: $name\nat  : $when\nType: $type";
        if ( !isset ( $IPtriggers[$keyIP] )) {
                $IPtriggers[$keyIP] = 1;
        } else {
                $IPtriggers[$keyIP] += 1;
        }
}
#echo "\n\nShow how many rules theese Adressess triggered?\n";
#print_r ($IPtriggers);
#echo "Block all adresses that trigged any rule.\n";
foreach ( $IPtriggers as $IPKey => $nmGuilt ) {
#       echo "Blocking address: $IPKey\n";
        passthru ('iptables -A INPUT -s '.$IPKey.' -j DROP', $ret);
        if ( $ret <> 0 ) {
                echo ("Problem setting firewall!\n");
                exit (1);
        }
}
?>

• international prefixes configuration
  • international prefixes - to distinguish between local and international calls you have to add here list of prefixes. Default are +, 00
  • min international length - if destination number is less then this value it will be not treated as international but local.
  • local numbers are in - select the country to which local calls belongs. This will allow to classify calls with international prefix as a local number.

= SIP REGISTER flood / attack

Alert is triggered when sniffer detects >= N number of registration attempts from some IP during set interval.

Realtime concurrent calls

This anti-fraud rule (and the purpose is not only for fraud) works in realtime and it is not based on CDR. It tracks each source IP and count number of concurrent call. The advantage of tracking concurrent calls in realtime and not based on CDR is obvious and it helps to compete attacks which creates many channels at the same time with long duration. You can set this parameters:

• Concurrent calls limit - You can choose to trigger alert only if international calls is over the limit or only local calls or both calls.
• Time period rules - you can limit that the alert will work differently during work hours and after hours. Time periods are defined in Main menu -> Groups -> Time periods

change cdr country

Alert is triggered when the last CDR changes IP source which is in different country or continent since last call. You can set this parameters:

• Exclude country form alert: you can whitelist certain countries which will not trigger the alert.

change register country

Alert is triggered when the last SIP REGISTRATION for some username changes country or continent since last successful registration.

• Exclude country form alert - you can whitelist certain countries which will not trigger the alert.

country/continent destination

Alert is triggered when someone is calling to specific country or continent. This alert is based on first SIP INVITE and not from CDR thus it works in realtime.

SIP PACKETS flood attack

Alert is triggered when sniffer detects >= N number of packets from some IP during set interval.