mobile network a sri sm req - mipro · infobip ltd / products and solutions dpt., zagreb, croatia...
TRANSCRIPT
Mobile network protection system against
fraudulent and unwanted messaging traffic
T. Gojević, K. Matas, M. Skomeršić and M. Žuvanić
Infobip Ltd / Products and Solutions dpt., Zagreb, Croatia
{tomislav.gojevic, kristijan.matas, marko.skomersic, marko.zuvanic}@infobip.com
In this paper, mobile network protection system against
fraudulent and unwanted messaging traffic is discussed.
Application to Person (A2P) messaging traffic is raising
every year and with that raise fraudulent and unwanted
traffic is gaining momentum as well. Home Location
Register (HLR) lookup, Short Message Service (SMS) and
Unstructured Supplementary Service Data (USSD) is
exchanged between mobile network operators and along
with regular traffic, there are also cases of traffic affecting
network performance, link utilization and subscriber
satisfaction. This paper will, discuss technical, commercial
and security challenges of the aforementioned messaging
traffic and how mobile network protection system can help
to solve them.
Keywords: mobile networks, SMS, HLR, USSD, A2P
I. INTRODUCTION
Total SMS traffic in the world is expected to reach
9.089,3 billion in 2012 from 8.015,5 billion in 2011[1].
Along with the increase in regular Person to Person (P2P)
and Application to Person (A2P) SMS traffic, there is
also a huge increase in unwanted and fraudulent SMS
traffic, and vast numbers of HLR lookups and USSD
traffic that is either not regulated or it is used for some
other purposes than the one it was created for.
All of the aforementioned trends significantly
influence mobile network performance; link utilization
and subscriber (dis)satisfaction, which leads to subscriber
churn and potential loss of revenue for a mobile network
operator (MNO).
To minimize these issues, mobile network operators
were looking for a platform, similar to a firewall, to
protect their network against various cases of spam,
signalling overload, faking inside SS7 signalling parts of
the message, theft of identity and unbalanced messaging
traffic.
The only way to analyse and essentially stop
fraudulent messaging traffic in real time is to integrate an
SS7 analysing system directly on the signalling links.
This way an MNO is able to detect all unwanted
messaging traffic without any delay, which leaves no
time for the fraudsters to adapt and change the patterns of
behaviour.
II. TECHNICAL BACKGROUND
Standard SMS signalling flow, composed of HLR
lookup and followed by SMS delivery, is displayed on Figure 1.
SMSC
SRI_SM_REQ
SRI_SM_RESP
MOBILE network B
HLR MSC/VLR
MT_FWD_SM
MT FSM ACK
MOBILE network A
Figure 1.
Standard SMS signalling flow
Standard network initiated USSD signalling flow is
depicted below on Figure 2.
USSD GW
SRI_SM_REQ
SRI_SM_RESP
MOBILE network B
HLR MSC/VLR
PROCESS_UNSTRUCTURED_SS_REQUEST
PROCESS_UNSTRUCTURED_SS_REQUEST
MOBILE network A
...
Figure 2.
Standard USSD signalling flow
784 MIPRO 2012/CTI
When sending signalling messages to other networks,
mobile network nodes use, among other distinctive
marks, addresses – Global Titles (GT) to represent
themselves to other network nodes. GT is written in two
different layers of an SS7 signalling message, Signalling
Connection Control Part (SCCP) [2] and Mobile
Application Protocol (MAP) [3]. From its beginning, SS7
was a relatively closed network community; with none or
very little access to external parties e.g. service providers.
But in the recent years mobile network operators have
started to open their networks and provide access to the
SS7 signalling network, to external parties. That resulted
in usage of HLR, SMS and USSD signalling messages
for other purposes that originally intended. Mobile
network operators have some very basic and crude ways
of stopping unwanted messaging traffic, but there is no
bulletproof way of stopping various manipulations on the
SCCP and MAP level i.e. changing of Global Titles to
bypass basic blocking rules inside network nodes.
Below are various techniques on how to avoid basic
blocking rules and cases that are troubling the mobile
network operators:
SMS Fake – occurs when an incoming
message (MT_FWD_SM) comes from a
foreign SMSC, and terminates at one of the
receiving operator’s VLR/MSCs. The
message bears a manipulated originating
address, destination address, or other
items.[4]
SMS spoofing – SMS-MO (coming into
operators network from a foreign
VLR/MSC, and terminating at operators
network SMSC) which bears a wrong
originating address, a wrong destination
address, or other manipulated items.[4] SMS Spam – occurs when the receiving
network clients receive unsolicited SMS
Unbalanced HLR, SMS and/or USSD traffic
– occurs when an operator receives more
messaging traffic from a certain partner
operator than it sends back. This results in a
signalling misbalance and higher costs for
the receiving operator
Unsolicited USSD – occurs when an
operator clients start to receive unsolicited
USSD sessions to their mobile phone
screens. USSD is not regulated and there are
virtually no benefits for the receiving
network
To be able to handle these cases, mobile network
operators should use a robust system that is placed
directly on the signalling links.
Figure 3.
MNO protection system
As shown on Figure 3, MNO protection system can be
deployed in two different ways; passive, where the
system doesn’t interfere with the signalling flow but
rather receives a carbon copy of the signal attenuated by -
20 or -30 dB (so it doesn’t interfere with the original
signal) through a Protected Monitoring Point (PMP) [5]
and analyses it; active, where the system is directly on the
signalling link and it can interfere with the signalling
flow e.g. stop a signalling unit, or generate a “dummy”
response as if was coming from a real network node.
MNO protection system receives the Message Signal
Unit (MSU) on the monitored E1 link(s) and analyses
SCCP and MAP parts of an MSU is displayed in Figure
4.
------------------------------------------------------
SCCP ITU
------------------------------------------------------
IE: Called Party Address
00001000 Subsystem number (SSN) = 8 (MSC)
00000000 Translation type (TT) = 0 (unknown)
0001---- Numbering Plan (NP) = 1 (ISDN/telephony numbering plan
(Recommendations E.163 and E.164))
-0000100 Nature of Address Indicator (NAI) = 4 (international number)
0------- Spare = 0 (Spare field (1 bit))
Address signals = 18763800XXX
IE: Calling Party Address
00001000 Subsystem number (SSN) = 8 (MSC)
00000000 Translation type (TT) = 0 (unknown)
0001---- Numbering Plan (NP) = 1 (ISDN/telephony numbering plan
(Recommendations E.163 and E.164))
-0000100 Nature of Address Indicator (NAI) = 4 (international number)
0------- Spare = 0 (Spare field (1 bit))
Address signals = 3859XX000000
------------------------------------------------------
MAP
------------------------------------------------------
application-context-name = { 0 4 0 0 1 0 21 3 } (shortMsgMO-RelayContext-v3)
OP Code = 46 (MO-ForwardSM)
MAP-SM-DataTypes.MO-ForwardSM-Arg
sm-RP-DA = serviceCentreAddressDA
Address signals = 385XX3800XXXf
sm-RP-OA = msisdn
msisdn = 91 81 67 74 70 59 f2
Address signals = 18764707XXXf
imsi = XXXXX0000139753f
Figure 4.
MNO protection system
Parts that are in bold and italic should be the same,
but by manipulation on the MAP layer, third party that
has access to the MNO signalling network is able to
bypass basic blocking rules by implementing a so called
trusted GT inside MAP layer.
MIPRO 2012/CTI 785
MNO protection system is able to detect any kind of
manipulation on either SCCP or MAP layer, along with
tracking of:
Incoming and outgoing traffic balances –
shows that there are some mobile networks
that are sending a lot of A2P and spam
traffic. Counting of incoming and outgoing
SMS
Signalling link (over)load – shows Denial
of Service (DoS) attempts. Counting of
signalling MSU messages in a pre-defined
time window
Excessive HLR lookup requests – shows an
misuse of HLR lookups which should be
used only for routing purposes. Counting of
incoming HLR lookups compared to
incoming SMS coming from the same
network, measured ratio greater than 2.5
should be considered as fraudulent activity.
SMS spam – unwanted SMS traffic, not
requested by the user. Counting of all
incoming SMS that have in their SMS text
words or phrases that are on the spam
definition list
Unsolicited USSD traffic – unwanted
USSD traffic, not requested by the user.
Counting of incoming USSD related
signalling MSU messages
III. IMPACT ON MOBILE OPERATORS
Mobile network operators, like mentioned before, are
facing issues with misuse of their signalling network and
subscriber churn, but there is also one impact most
measurable just by a glance at the traffic volume figures.
Mobile network operators exchange, on a daily basis,
hundreds of thousands or even millions of HLR, SMS
and USSD messages. If these figures, when comparing
incoming and outgoing traffic, are roughly the same it
means that the network is pretty well protected, but if
these figures are greatly misbalanced, it means that the
MNO is poorly protected.
There is an example of incoming and outgoing
messaging traffic for one day in figure 4 and figure 5,
where it is very clear that there is a huge misbalance of
incoming and outgoing traffic (approx. 350 000 messages
during peak time).
Figure 4.
Incoming messaging traffic
Figure 5.
Outgoing messaging traffic
Mobile operator doesn’t have the means to capture
and detect these kinds of anomalies in the messaging
traffic in real time, but rather this was detected after
analysing the Call Data Records (CDR), with at least 24
hour delay.
With a network protection system the following
information were at hand immediately:
Country from where the traffic originated
Network from which the traffic originated
Global Title (GT) from which the traffic
originated
Type Of Number (TON) of the senders
Sender identification
Extracts from the reports that are provided in real time
to the mobile network operators, which contain the
aforementioned data is shown in Figure 6 and Figure 7.
786 MIPRO 2012/CTI
Figure 6.
SMS traffic misbalance report
Figure 7.
Sender identification and TON report
Figure 6 shows the SMS traffic misbalance i.e. it shows
the ratio of incoming to outgoing SMS traffic, the graph
shows that the incoming traffic is much bigger in volume
compared to the outgoing traffic. This means that the MNO
is receiving a lot of A2P SMS traffic, which is entering the
network without his knowledge, and ultimately without
financial benefit for the MNO.
Figure 7 shows top networks from where the SMS traffic
is coming from. Looking at this graph, the MNO can
immediately know what kind of SMS traffic is entering the
network e.g. alphanumeric senders (e.g. BARCLAYS
BANK), international senders (e.g. 447781234567). By
gaining knowledge on what kind of traffic is entering the
network, MNO can better adjust the protection system to
block certain type of traffic.
By implementing the mobile network protection system,
the MNO can eliminate the entire traffic with alphanumeric
senders, international senders that repeat themselves, Global
Titles which are used for A2P traffic exclusively, SMS
fraudulent traffic and SMS spam. SMS spam and unwanted
A2P traffic are toughest to detect and the mobile network
protection system needs to be updated regularly to maintain
a high rate of detection of 80 up to 87% of the
aforementioned cases
IV. CONCLUSION
This paper addresses potential threats and risks that are
rising along with the raise of global messaging traffic,
especially A2P, and gives an example of how those threats
and risks could be mitigated with a network protection
system. Not only that the network protection system would
help mobile network operators to gain real time insight on
what is happening on their signalling links, but it could also
help them protect their end customers, influence the
regulators to improve the deficiency of relative laws and
regulations [6] and ultimately operators could protect their
revenue too.
REFERENCES
[1] Mobile Messaging Futures 2011-2015, Analysis and Growth
Forecasts for Mobile Messaging Markets Worldwide: 5th edition, Portio Research Limited, 2011.
[2] ITU-T Q.711, “SERIES Q: SWITCHING AND SIGNALLING, Specifications of Signalling System No. 7 – Signalling connection control part (SCCP), Functional description of the signalling connection control part”, Mar. 2001.
[3] 3GPP TS 29.002, “Mobile Application Part (MAP) specification”, Dec. 2011.
[4] GSMA doc. AA.50, “SMS Fraud Criteria”, Aug. 2004.
[5] ITU-T Q.772, “GENERAL ASPECTS OF DIGITAL TRANSMISSION SYSTEMS”, Mar. 1993.
[6] Chen Yong-feng, “Causes and Countermeasures of Fraud Cases by SMS”, Journal of Beijing People’s Police College, Feb. 2006.
[7] Huang Liang-you, “On the Fraud by Mobile Phone Short Message and Its Countermeasures”, College of Law, Chongqing University of Posts and Telecommunications, Chongqing, Jun. 2008.
[8] Asival M., Sirat D:, Susatyo B., Electr. Eng. Dept. Univ. of Inodneisa, Depok, “Design and analysis of anti spamming SMS to prevent criminal deception and billing fraud: Case Telecom Flexi”, Management of Innovation and Technology, 2008.
MIPRO 2012/CTI 787