Regional Workshop on IT Security

1. CoE/ROAS/ITU Regional Workshop on IT Security Middle East Communications Corporation (MEC) MEC Consulting (MECC) Jamal Salameh October 20 – 22, 2003 Fraud Management System FMS

2. Abbreviations CDR: Call Detailed Record DOD: Direct Outward Dialing DTMF: Dial-Tone Multi Frequency FMS: Fraud Management System FWD: Free World Dialup IAA: Inter-Administration Accounting IPL: International Private Line ISP: Internet Service Provider ITF: International Toll Free LCR: Least Cost Route LEC: Local Exchange NISC: National / International Switching Center PLMN: Public Land Mobile Network POTS: Plain Old Telephone Services PRS: Premium Rate Service PSTN: Public Switched Telephone Network SLAs: Service Level Agreements VAS: Value Added Service8888666

3. Definition • Fraud Types • Sample of Fraud Activities • Fraud Cases • Why Fraud • Fraud Systems Classification • Total Fraud System • Features • Configuration • Capabilities • Design • Fraud Technology • Intrusive System • Comparison • FMS Benefits • Fraud Detection Filters – Sample • FMS Applications • FMS & QoS • Conclusion Agenda

4. Definition • Illegal Activity • Unlicensed Service • It’s easier to be defined by source • Licensees • Individual Customers • Corporate Customers • Operators • PSTN • PLMN • ISPs • Frequency Overlapping

5. Fraud Types Mobile Fraud International Toll Free Fraud Subscription Fraud PBX Fraud TELECO Payphone Fraud Clip On Fraud Premium Rate Service Fraud

6. Sample of Fraud Activities • POTS • Clip On • Subscription • Call Back • Payphones • Leaky PBX • Mobile • Cloning • Time Distance • Roaming • Subscription & Prepaid Cards

7. Fraud Activities… Cont. • VAS • Calling Cards • ITF • PRS • IPL – International Private Line • IP Fraud • VOIP • PC2Phone • IP Phones • Peer-to-Peer (Voice) – Skybe Me? Skybe You? www.boardwatch.com/document.spa?doc_id=39569) • FWD – Free World Dialup

8. Fraud Cases 1-Leaky PBX Destinations DOD – Direct Outward Dialing PBX Customer

9. Fraud Cases 2-Traffic Termination Internet Cloud POP PBX PLMN PSTN

10. Country ( B ) Platform Fraud Cases 3-Calling Cards Platform (2nd / 3rd Country) Country ( C ) Country ( A ) Platform Customer

11. Fraud Cases 4-Frequency Overlapping Customer ( A ) Country ( B ) Country ( A ) Customer ( B)

12. Fraud Cases 5-IP Phones World Internet Cloud POP PC IP Phone

13. Fraud Cases 6-ITF: International Toll Free Country ( D ) Individual Customers Country ( C ) Corporate Customers Individual Customers Country ( B ) Country ( A ) Individual Customers ITF Platform N.B. 00269800xxxxx Fraudulent Traffic could be originated if the price of ITF call is cheaper than the price of the call from Country ( A ) to Country ( C ) or to Country ( D )

14. Why Fraud Telecommunications Revolution / Deregulation More Products & Services Customer in Charge Fierce Competition

15. So What • Fraud has become a Growing & Dynamic Industry • Lost Revenue = $15 BN • Lost Bandwidth • Hacking is a Dynamic Rich Industry • Revenue Leakage • Lost CDRs • SLAs • Disputed IAA • Network Problems

16. Fraud Systems Classification Design Vendor Technology • In-Band • CDR • Out-of-Band Signaling • Total System • Integrated • Manual • IP / New • Upgradeable

17. Total Fraud System Features: • Open System Architecture • Distributed Data Collection • CDR & Pre-CDR Builder • Common Data Repository • Connectivity with Other Systems

18. Total Fraud System cont… • Advanced Probes • Integrated E1/T1 Trunks Should Provide: • Monitoring SS7 Protocol • Monitoring In-Band Signaling • Classifying In-Band Bearer (voice, fax, data) • Detecting In-Band DTMF • Providing In-Band Intrusive Mode of Operation, Injection of Signals, Voice & Fax

19. Total Fraud Configuration Probes Wired directly into voice & Signaling links Destinations Destinations 1 NISC 2 NISC E1s Voice E1s Signaling LEC 1 LEC 1 FMS Customers Customers

20. Total Fraud Capabilities • Real Time Pre-CDR Central Computer • Real Time CDRs • Classification Voice, Fax, Data • DTMF Detection Probe • SS7 Links • Block Calls in Real Time Voice Links Signaling Links

21. System Design CDR Computer Calls Related Events Database Probe Signaling Links Voice Links Network Element Network Element Interface Point Interface Point PSTN PSTN

22. Fraud Technology Fraud Intrusive Vs CDR Dependent Systems Intrusive solutions provide QoS measurements from end-user perspective, while non-intrusive solutions provide QoS measurement from carrier’s perspective

23. Intrusive Features • Pure Information • From Trunks not Switches • Call Monitoring as they are made • Pre-CDR • Classifying Calls • Hidden Control Messages Detected • Correlating Data • Combination Data Show Abuse • Ability to Disrupt Calls & Produce Alerts

24. Comparison

25. Comparison cont…

26. Benefits of Real Time FMS • Prevention of illegal entrance to network • Elimination of usage abuse of network • Drastic reduction of revenue losses • Drastic reduction of customer churn • Improve competitive positioning • Reduce resources dedicated to legacy system • Reduce resources dedicated to bad debt collection • Reduce customer complaints

27. Sample of Fraud Detection Parameters / Filters • No. of calls / day / customer • No. of calls destined to same called number • Call duration • DTMF – Dialed Digits Length • Access codes of specific operators • CLI of I/C International Calls • IPLs Monitoring

28. FMS Applications • Elimination of most sorts of fraud activities • Effective tool for revenue assurance throughout minimizing revenue leakage • Monitor & improve QoS • Minimize disputed inter-carrier billing

29. FMS & QoS Implementation Process • Confirm critical business, operational strategies & objectives • Define network performance strategies • Assess testing & simulation capabilities • Develop high-level baseline of key performance indicators • Identify high-priority potential improvements • Define all the specific steps with estimate of costs and benefits • Present to senior management with recommendations

30. QoS Control • Interfaces at E1 & T1 monitor points • Does not disrupt network traffic • Collect quality and performance measurements on live data • Large volume of call records can be generated in short time • Provide data for traffic engineering and management • Store & forward results to central data base • Provide tailored analysis and statistical reports in user-friendly format

31. QoS Benefits Business & Financial • Grow & protect revenues and market share • Reduce Opex • Increase profit growth & margins Marketing • Enable product / service roll outs • Support service level guarantees • Provide continuous competitive benchmarking Operations • Reduce network unit costs • Ensure competitive QoS • Enable rational circuit-switched / packet network convergence

32. QoS Benefits cont… • Evaluation of QoS provided or required • To other Carriers /Customers • By other Carriers • Traffic Engineering • LCR optimization • Useful marketing information

33. Conclusion • FMS is as good as its user’s ability to plan / select / implement / use and capitalize on it • FMS can help in reducing fraud activities, improve revenue assurance, decrease disputed IAA probles and control QoS • Keep updating: • Fraud & anti-fraud activities are dynamic industry

34. Conclusion cont… • It is hard to detect the fraud activities in the era of technology revolution: • IP Phones • Peering-to-Peering (P/P) • Free World Dial-up (FWD) • Real time content (RTC) server • The most effective anti-fraud activity is: • Deregulation…Open market authorization instead of licensing • Lower prices as result of open market

35. Conclusion cont… • Historically: • What was illegal Yesterday, may now be considered legal Today • What is illegal Today, may become legal Tomorrow

36. Thank you Jamal Salameh MECC Middle East Communications Corporation Consulting Jsalameh@mec.com.jo