This section describes the FAST SIMBOX Check Application.

Alarming/Alerting Functionality

The FAST application contains a highly flexible Fraud Detection Engine for the definition of Rules to detect SIMBOX behaviour or Interconnect fraud scenarios.

The system comprises a large set of attributes from xDRs as well as aggregated behavior patterns and these can be combined with flexible mathematical operators to build rule formulas.

Data analysis can be executed focussing on single subscribers on MSISDN or IMSI basis.

The system supports different analysis intervalls from few hours to multiple days.

Via a Profiler a subscriber individual view into the longterm behaviour is possible.


SIMBOX specific attributes and example rules

For the SIMBOX analysis a set of specific behavioral attributes have been added to the system, as are shown in the following table.


Attribute Usage
COUNT_DIFF_VOICE_CALLS Count the number of different B-Number targets numbers observed for a subscriber.
CALL_VARIATION Measures the statistical deviation to identify to which extent the calling behavior is close to a line being occupied 100 % of the  time
DAY_FACTOR Measures to which extent the line observed follows a profile, which is for 90 % active during daytime.
NIGHT_FACTOR Measures to which extent a line observed follows a night active scheme
PRIVATE_PROFILE Measures to which extent a line observed exposes a private profile
BUSINESS_PROFILE Measures to which extent a line observed exposes a busines profile
NUMBER_DIFFERENT_CELLS Will measure the mobility of the IMSI/ID during the given observation period.


To demonstrate a typical rule for Simbox here an example for a simple rule fragment:


(make more than > 50 calls during 24 hours)                                                AND

(do not receive an SMS)                                                                                      AND

(the ratio between incoming calls and outgoing calls is lower than 5 %) AND

  ((and the portion of outgoing calls to the own network is higher than 90 %)


(and the number of different cells being used is less than 5))                       AND

(3 calls are made out of a SIMBOX Cell Hotlist)


FAST TrafMiner

This module allows to datamine the xDR data streams provided from the specific network.

Amongst others the traffic between networks, incoming outgoing ratios, the identification of unidentified traffic, the cell distribution and a large set of other data queries can be computed.


Definition of a SIMBOX Rule set

Based on the OpTech analysis of network data (with TrafMiner) and the above given key features for rule definition, OpTech can configure a set of rules.

Rules will cover the following aspects:

  • Different time intervalls
  • Different types of SIMBOX behaviour
  • Different target networks (intra-network or external networks)
  • Different tariff modells or budget tariffs

Hotlists can be configured, to ease the future SIMBOX detection, by analyzing the typical cell sites of former SIMBOXes.

Alarming and Notification of Operators

The module supports the automatic notification of operator personnel.