This section describes the FAST SIMBOX Check Application.
The FAST application contains a highly flexible Fraud Detection Engine for the definition of Rules to detect SIMBOX behaviour or Interconnect fraud scenarios.
The system comprises a large set of attributes from xDRs as well as aggregated behavior patterns and these can be combined with flexible mathematical operators to build rule formulas.
Data analysis can be executed focussing on single subscribers on MSISDN or IMSI basis.
The system supports different analysis intervalls from few hours to multiple days.
Via a Profiler a subscriber individual view into the longterm behaviour is possible.
SIMBOX specific attributes and example rules
For the SIMBOX analysis a set of specific behavioral attributes have been added to the system, as are shown in the following table.
|COUNT_DIFF_VOICE_CALLS||Count the number of different B-Number targets numbers observed for a subscriber.|
|CALL_VARIATION||Measures the statistical deviation to identify to which extent the calling behavior is close to a line being occupied 100 % of the time|
|DAY_FACTOR||Measures to which extent the line observed follows a profile, which is for 90 % active during daytime.|
|NIGHT_FACTOR||Measures to which extent a line observed follows a night active scheme|
|PRIVATE_PROFILE||Measures to which extent a line observed exposes a private profile|
|BUSINESS_PROFILE||Measures to which extent a line observed exposes a busines profile|
|NUMBER_DIFFERENT_CELLS||Will measure the mobility of the IMSI/ID during the given observation period.|
To demonstrate a typical rule for Simbox here an example for a simple rule fragment:
(make more than > 50 calls during 24 hours) AND
(do not receive an SMS) AND
(the ratio between incoming calls and outgoing calls is lower than 5 %) AND
((and the portion of outgoing calls to the own network is higher than 90 %)
(and the number of different cells being used is less than 5)) AND
(3 calls are made out of a SIMBOX Cell Hotlist)
This module allows to datamine the xDR data streams provided from the specific network.
Amongst others the traffic between networks, incoming outgoing ratios, the identification of unidentified traffic, the cell distribution and a large set of other data queries can be computed.
Definition of a SIMBOX Rule set
Based on the OpTech analysis of network data (with TrafMiner) and the above given key features for rule definition, OpTech can configure a set of rules.
Rules will cover the following aspects:
- Different time intervalls
- Different types of SIMBOX behaviour
- Different target networks (intra-network or external networks)
- Different tariff modells or budget tariffs
Hotlists can be configured, to ease the future SIMBOX detection, by analyzing the typical cell sites of former SIMBOXes.
Alarming and Notification of Operators
The module supports the automatic notification of operator personnel.