real time fraud detection using signalling

WeD

o T

echnolo

gie

s ©

2015 –

confidential

info

rmation

. A

ll rights

reserv

ed.

June 16, 2016 | Page 1June 16, 2016 |

REAL TIME FRAUD DETECTION USING SIGNALLING

SPEED AND AGILITY

May 2016

Luis Moura Brás [email protected]

Stephen [email protected]

WeD

o T

echnolo

gie

s ©

2015 –

confidential

info

rmation

. A

ll rights

reserv

ed.

June 16, 2016 | Page 2June 16, 2016 |

CONTACTSLuis Moura Brás

Stephen Buck

LUIS MOURA BRÁS

FRAUD EXPERT

+351 939 640 388

[email protected]

STEPHEN BUCK

PRODUCT DIRECTOR

+44 7710 468 572

[email protected]

WeD

o T

echnolo

gie

s ©

2015 –

confidential

info

rmation

. A

ll rights

reserv

ed.

June 16, 2016 |

TOPICS COVERED

1 How is fraud evolving

2

3

5

Real time fraud management

New dimensions on fraud use cases

Benefits of integrated fraud management approach

4 Real time solution architecture

WeD

o T

echnolo

gie

s ©

2015 –

confidential

info

rmation

. A

ll rights

reserv

ed.

June 16, 2016 |

THE FRAUD IN TELCOMARKET OVERVIEW

WeD

o T

echnolo

gie

s ©

2015 –

confidential

info

rmation

. A

ll rights

reserv

ed.

June 16, 2016 |

FRAUD LANDSCAPE MOST RELEVANT FRAUD TYPES

The fraud types incidence may vary according to market maturity and ARPU. CFCA report covers the fraud

loss estimations at a global scale (e.g., thus not taking in account differences between region/market

and/or country environmental)

WeD

o T

echnolo

gie

s ©

2015 –

confidential

info

rmation

. A

ll rights

reserv

ed.

June 16, 2016 |

FRAUD MANAGEMENT SOLUTIONS ADDRESSING INCREASING SOPHISTICATION OF FRAUDSTERS

• Fraudsters understand the time window and act fast – need to trap in real time

• Fraudsters now have access to (SS7) networks – new fraud risks to address

• VoIP/SIP traffic – New forms of bypass and spoofing to address

Real time

INFORMATION

Technology change

(SS7 fraud, SIP)

WeD

o T

echnolo

gie

s ©

2015 –

confidential

info

rmation

. A

ll rights

reserv

ed.

June 16, 2016 |

WHAT IS THE DIFFERENCE? – A GROSS SIMPLIFICATION SIGNALING V CDRS

RADIO ACCESS NETWORK CORE NETWORK

Eg: BTS/BSC,

NodeB/RNC,

eNodeB

Eg: VLR, MSC, SGSN

SGW, PGW, MME

1. Register location and set up services in VLR

Manage secure, efficient, low error radio

communication

Manage mobility, routing, authentication and

service control

Routing of calls,

data in/out

(Eg: ISUP)

Managing mobility, AAA

etc (eg: MAP)

Control calls, data etc

(eg: CAP)

HLR

AS

VPLMNHPLMN

Eg: Prepay, Policy, AAA

1. No CDRs. HPLMN aware

2. Make call 2. Call info visible and under

control of home. No CDRs yet.3. Terminate call

3. CDRs generated in VPLMN

4. NRTRDE/TAP sent to HPLMN

BSS

Mediation

CDRs

WeD

o T

echnolo

gie

s ©

2015 –

confidential

info

rmation

. A

ll rights

reserv

ed.

June 16, 2016 |

Both contain:

• Origin, destination,

• Date, time, length of calls, data volumes, text etc

• Cell id

• Primary purpose – control of UE

• Real-time

• Controls calls, data, text – can block/allow/interact

• Some additional information – eg: mobility, device

• Multiple interfaces & protocols with different info

Call Detail Record (CDRs):

WHAT IS THE DIFFERENCE? – A GROSS SIMPLIFICATION SIGNALING V CDRS

• Primary purpose – billing and charging

• Post event

• Low delay at home, but significant delay when roaming

• Some information not easily accessible in signaling – eg: QoS

• Multiple entities write CDRs or equivalent

WeD

o T

echnolo

gie

s ©

2015 –

confidential

info

rmation

. A

ll rights

reserv

ed.

June 16, 2016 |

REAL-TIME FRAUD DETECTION SYSTEM

INTEGRATED FRAUD MGMT. SOLUTION

evolvedintelligence

WeD

o T

echnolo

gie

s ©

2015 –

confidential

info

rmation

. A

ll rights

reserv

ed.

June 16, 2016 |

60 live deployments

over 38 customers

worldwide

2 Bn messages

processed per day

35m roamers seen

per day

1.75 TB of

signalling

processed daily

Signalling of 600

operators from

210 countries

daily

10

EvolvedintelligenceCLOUD BASED NETWORK SOLUTIONS

WeD

o T

echnolo

gie

s ©

2015 –

confidential

info

rmation

. A

ll rights

reserv

ed.

June 16, 2016 |

• Address fraud in real time to reduce fraud window.

• Use signaling information to enrich analysis of activity to improve

detection

REAL TIME FRAUD MANAGEMENT SOLUTION BRINGING NEXT-GENERATION FRAUD DETECTION INTO YOUR BUSINESS

• RAID FMS existing data sources and rules extended with Evolved

Intelligence capability to interact with network in real time

• Faster, sharper and smarter fraud detection capabilities

• Extending CDR analysis to real time (eg: parallel calls, B-numbers, call

symmetry/volume etc) – eg: SIM box detection IRSF, IMEI stuffing

• Identifying signaling fraud (VoIP and SS7) – eg: spamming, CLI spoofing

Why

How

What

WeD

o T

echnolo

gie

s ©

2015 –

confidential

info

rmation

. A

ll rights

reserv

ed.

June 16, 2016 |

USE CASESFRAUD SCENARIOS

WeD

o T

echnolo

gie

s ©

2015 –

confidential

info

rmation

. A

ll rights

reserv

ed.

June 16, 2016 |

ROAMING FRAUD USE CASE

$$$$$

FM

S

HPLMN

VPLMN

REAL TIME CONTROL

FLEXIBLE RULES

CAP

EXISTING CAMEL

TRIGGERS (OR NEW)

IMMEDIATE ANALYSIS AND

ACTION:BLOCK CALLS

ASK USER

B NUMBERPARALLELFREQUENT(NOT JUST

CREDIT LIMIT)

SIMPLE TO IMPLEMENT

MINIMAL FRAUD

WINDOW

FASTER ACTION

FEWER FALSE POSITIVES

ALL ROAMERS

NEW SIMS

Real time monitoring and intervention on

roaming calls to reduce fraud window

WeD

o T

echnolo

gie

s ©

2015 –

confidential

info

rmation

. A

ll rights

reserv

ed.

June 16, 2016 |

SS7 FRAUD (SPAMMING, SPOOFING ...)USE CASE

HPLMN

SPAM

EVESDROP CALLS AND MESSAGES

MAP/CAP, Diameter etc

TRACK LOCATION

SPOOF USER AND SEND MESSAGES

BLOCK SERVICE

IDENTIFY DEVICE

HACK VOICEMAIL

DIVERT CALLS TO PREMIUM

MODIFY SERVICE FLAGS

(EG:PREPAY)

http://www.9jumpin.com.au/show/60minutes/stories/2015/august/phone-hacking/

http://www.cbsnews.com/videos/hacking-your-phone/

FM

S

http://www.9jumpin.com.au/show/60minutes/stories/2015/august/phone-hacking/

http://www.cbsnews.com/videos/hacking-your-phone/

WeD

o T

echnolo

gie

s ©

2015 –

confidential

info

rmation

. A

ll rights

reserv

ed.

June 16, 2016 |

HPLMN

VALIDATE ADDRESS

CHECK MESSAGE

MAP/CAP, Diameter etc

CHECK PLAUSIBILITY

CHECK FOR SPOOFING,

CONSISTANCY AND SOURCE

OK FROM THIS ADDRESS (VPLMN,

HPLMN, ROAM PARTNER)

PROTECT PRIVACY

REDUCE FRAUD

PREVENT SPAM AND DOS

VELOCITYTIMINGSTATE

SS7 FRAUD (SPAMMING, SPOOFING ...)USE CASE

Validate address, sender and purpose of

signalling messages to minimise signalling fraud

FM

S

WeD

o T

echnolo

gie

s ©

2015 –

confidential

info

rmation

. A

ll rights

reserv

ed.

June 16, 2016 |

IMEI STUFFINGUSE CASE

$$$$$

HPLMN

VPLMN

REAL TIME CONTROL

FLEXIBLE RULES

MONITOR ALL ROAMERS


ACTION :BLOCK CALLS

ASK USER

INTL B NUMBERNOT HOME/LOCAL

FREQUENTIMEI CHANGECREDIT LIMIT

SIMPLE TO IMPLEMENT

MINIMAL FRAUD

WINDOW

FASTER ACTION


MONITOR INTL SIGNALING

CAMEL (GTPc)

Identify in real time unusual call pattern and

IMEI change to limit fraud loss from stolen SIMs

FM

S

WeD

o T

echnolo

gie

s ©

2015 –

confidential

info

rmation

. A

ll rights

reserv

ed.

June 16, 2016 |

SIM BOX AND BYPASSUSE CASE

HPLMN

REAL TIME CONTROL

FLEXIBLE RULES

TRIGGER ON FLEXIBLE SET

OF IMSI


ACTION :BLOCK CALLS

ASK USER

CALL & TXT VOLUME

MO/MT BALANCEFIXED LOCATION

IMEICLI

RISK TRADEOFF

REDUCED FRAUD

WINDOW


NEW IMSIRISKY TARIFF

IMSI SCAN

Monitor calling behavour on target IMSI to identify

and block SIM box

FM

S

CAP

WeD

o T

echnolo

gie

s ©

2015 –

confidential

info

rmation

. A

ll rights

reserv

ed.

June 16, 2016 |

RAID + ENGINE: ARCHITECTUREIMPLEMENTATION OPTIONS

Rule

DefinitionFRAUD SERVICES

INTEGRATION

USERINTERFACES

Mediation Network

We

Do

RA

IDE

vo

lve

d I

nte

llig

ence

EN

GIN

E

Detection and Correlation

Alarm Scoring

Rule Execution Engine Analysis

Service / Rule execution

Message and dialogue handling

Signalling Stack and Network Interface

KPI and reporting

Signalling Logs

Alarms

High Availability

Case Mgmt., KPI and reporting KPI and reporting

Event Analysis

Signalling Logs

Event records

and Alarms

Provisioning

(Rules, IMSI etc)

Rules

CRM etc

• Rules run in FMS;

• Easy (EDR v CDR) integration;

• Post event Detection (minutes);

• Some limits on use cases;

• Defines the fraud rules;

• Loads event records into RAID

FMS;

• Correlates with other events;

• Executes rules to identify fraud;

• Portal for KPI, reporting and

analysis for both systems;

• Integrates into network;

• Manages interception of appropriate

message flows for relevant IMSI /

MSISDN;

• Traps and records events;

Post event - Near real time

WeD

o T

echnolo

gie

s ©

2015 –

confidential

info

rmation

. A

ll rights

reserv

ed.

June 16, 2016 |

RAID + ENGINE: ARCHITECTUREIMPLEMENTATION OPTIONS

Rule

DefinitionFRAUD SERVICES

INTEGRATION

USERINTERFACES

Mediation Network

We

Do

RA

IDE

vo

lve

d I

nte

llig

ence

EN

GIN

E

Detection and Correlation

Alarm Scoring

Rule Execution Engine Analysis

Service / Rule execution

Message and dialogue handling

Signalling Stack and Network Interface

KPI and reporting

Signalling Logs

Alarms

High Availability

Case Mgmt., KPI and reporting KPI and reporting

Event Analysis

Signalling Logs

Event records

and Alarms

Provisioning

(Rules, IMSI etc)

Rules

CRM etc• Rules devolved to ENGINE;

• Real time detection & interaction

• Real time action;

• Post event as required;

• Defines the fraud rules;

• Loads event records into RAID

FMS;

• Correlates with other events;

• Executes additional rules;

• Portal for KPI, reporting and

analysis for both systems;

• Integrates into network;

• Manages interception of appropriate

message flows for relevant IMSI /

MSISDN;

• Devolved rules to identify and act on

fraud in real time;

Signalling Rules

Rules

Real time

WeD

o T

echnolo

gie

s ©

2015 –

confidential

info

rmation

. A

ll rights

reserv

ed.

June 16, 2016 |

NEXT-GENERATION FRAUD MANAGEMENT SYSTEM GAINS FOR THE MOBILE NETWORK OPERATOR

• Early fraud detection

• Immediate action

• Fewer false positives

• Improved insight into fraud behavior

• Reduced fraud window. Reduced loss

• Improved customer satisfaction

• Improved reaction time to new threats=

real time fraud detection using signalling

Documents