Configuring Rules
Fraud Monitor raises an incident if a given destination user receives unusually high traffic, as in an IRSF scenario. For each call, Fraud Monitor monitors the total number of minutes that the destination user has received the traffic and compares it to its historical average. If a configurable threshold is exceeded, both the source and destination users accumulate points. This rule can be used to identify possible candidates for blacklisting destination numbers.
Call Volume:
Fraud Monitor can raise an incident if a given destination user receives unusually high traffic rate as measured by Success Calls Per second or Max Active Calls.
For each call, Fraud Monitor, monitors the Success Calls Per Second that the destination user has received and compares it to its historical average (Success Calls are when 200OK for INVITE is received).
Simultaneously, it also monitors the Active Calls for that user. If a configurable threshold is exceeded for either Calls per second OR Max Active Calls, both the source and destination users accumulate points. This rule can be used to identify possible candidates for blacklisting or redirecting destination numbers.
Fraud Monitor uses configurable rules to find call patterns which are considered fraudulent and classify the severity of the incident with a points system. On the Rules section, you can decide which rules are used, configure them, and restrict their use.
The navigation bar on the right-hand side of the page lists the pre configured fixed set of rules you can use.
Figure 4-1 shows the navigation bar on the Settings page.
Figure 4-1 Navigation Bar on the Settings Page
Description of "Figure 4-1 Navigation Bar on the Settings Page"
Clicking on a rule opens up its configuration panel in the left column. Use the check boxes next to the rule name in the left column to enable and disable the rule.
Figure 4-2 shows an example of rules configuration.
Every configuration panel has Add, Edit and Delete buttons, which you can use to configure that specific rule. A brief help text is shown above the panel to aid you in the configuration process.
Every rule is assigned a weight. The default is 1.00. The rule weight can be used to make some rules more important than others.
To restrict the applicability of the rule, select the Rule Filters checkbox and enter the caller or callee information in the dialog box.
