About Fraud Monitor

Oracle Communications Session Monitor captures network traffic, correlates it in real time, and stores it in an indexed format for reporting by the browser interface. A multi-layered architecture ensures scalability, reliability and cost-effectiveness.

Figure 1-1 OCSM Architecture

The architecture has three layers:

• The Probe layer captures network traffic and performs Media Quality analysis.

• The Mediation Engine (ME) layer correlates network traffic and stores it for future reference. This layer also measures, manages and stores the KPIs. While there is usually one ME per geographic site, one site may have multiple MEs or probes from multiple geographical sites may send traffic to a single ME.

• The Aggregation Engine (AE) layer aggregates the global KPIs, with on-demand call correlation and global search features. In a typical setup, there is only one AE for the whole network.

The Session Monitor architecture consists of the Probe layer, Mediation Engine layer, and the Aggregation Engine layer (see the discussion about Session Monitor architecture in Session Monitor Installation Guide for information about the functions performed in each layer).

Fraud Monitor runs on the Aggregation Engine (AE) machine, but relies on the data provided by the Mediation Engines (MEs) to detect fraud. For each established call, the ME that has correlated the call, sends a notification to the AE, when the call is established, then one notification every few minutes and finally a notification at the end of the call. This allows Fraud Monitor to be aware of the real-time state of all the calls in the system and use this state to apply the different behavioral rules.