TransNexus

SIP Analytics®
Fraud Control

TransNexus – Private and Confid

 Value Proposition
• Fastest Fraud Protection Possible
– SIP Analytics® detects fraud before call setup
– Use SIP data not available in CDRs
• Easiest Integration
– Just point a SIP trunk from the softswitch or
SBC to TransNexus software for real time
fraud detection, call blocking or diversion
• Most Precise Fraud Control
– Normal traffic is not impacted
TransNexus – Private and Confid
 Highlights
• SIP Analytics® real time fraud detection by:
– Source IP address, Trunk Group, Calling Number
or SubscriberId
• Detects Traffic Pumping and Theft of Service
– Only fraudulent traffic pumping calls are blocked!
• Self learning fraud detection
• Real time call blocking or call diversion
• Protect Subscribers from Robocalls & Scams
• Simple integration with any Session Border
Controller (SBC)
TransNexus – Private and Confid
Overview

How SIP Analytics® Works

• Call Arrives at SBC
1 SIP PBX
NexOSS Alerts
E-mail &
SNMP
• SBC Forwards SIP Invite to 2. SIP 3. SIP
INVITE Response
NexOSS-FC SIP Phones
2 from Route,
Egress Divert
Interface or Block
• NexOSS-FC Instructs SBC:
1. Inbound
• If no fraud is detected, SIP Session
3 404 “Route as Normal” DID
SIP Calls
Border Softswitch
code returned and SBC Provider Controller
routes call to destination
• If fraud is detected, SIP 603
s
X
“Decline” code returned to
block the call or SIP 300
“Redirect’” message to
divert the call.

TransNexus – Private and Confid

 Also Works with a Softswitch
NexOSS E-mail, SNMP
& HTTP Alerts

PSTN Trunks 2. SIP 3. SIP

INVITE Response
& Lines from Route, Deploy NexOSS
Egress Divert
Interface or Block SIP Analytics with
SIP PBX
a softswitch to
Switch
Calls from
detect fraud on
1. Inbound
SIP Calls SBC Softswitch both SIP and
TDM traffic!
SIP Phones

TransNexus – Private and Confid

How It Works

SIP Analytics® - No Fraud

• Call Arrives at SBC
1
NexOSS Alerts
E-mail &
SNMP
• SBC Forwards SIP Invite to
NexOSS-FC 2. SIP
3. SIP
2 INVITE
Response
from SBC
• NexOSS-FC Response:
4. Call
No fraud is detected, SIP 404 Session Completed to
3 No Route Found code is
1. Inbound
Border Destination
returned to SBC Controller if no fraud
Call

• SBC completes the call

4

TransNexus – Private and Confid

How It Works

SIP Analytics® Fraud Blocked

• Call Arrives at SBC
1
NexOSS Alerts
E-mail &
SNMP
• SBC Forwards SIP Invite to
NexOSS-FC 2. SIP 3. SIP
2 INVITE Response
from SBC 603 Decline
• NexOSS-FC Response: 1. Inbound
Fraud is detected, SIP 603 Call Session
3 Decline code returned to SBC Border
4. Decline Controller
returned to
• SBC Blocks the Call call source
Decline message is proxied
4 back to the call source

TransNexus – Private and Confid

How It Works

SIP Analytics® Fraud Diverted

• Call Arrives at SBC
1
NexOSS Alerts
E-mail &
SNMP
• SBC Forwards SIP Invite to
NexOSS-FC 2. SIP 3. SIP
2 INVITE Response
from SBC 300 Redirect
• NexOSS-FC Response: 1. Inbound
Fraud is detected, SIP 300 Call Session
3 Redirect code returned to SBC Border
Controller

• SBC completes the call 4. Call

Call is routed to the IP address Completed to
4 in the Redirect message Diversion
Captcha
Destination
Gateway

TransNexus – Private and Confid

 Captcha Gateway
• Captcha Gateway prompts the caller to
enter a random 2 digit code.
– If correct, the call is transferred back to the
SBC for call completion.
– If not correct, the captcha gateway ends the
call.
• Captcha Gateway may also be used for
call recording.
TransNexus – Private and Confid
Monitor Registrations & Transfers
• IP packets mirrored to TransNexus probe.
• Probe software runs on any Linux host
• Probe forwards SIP NexOSS-FC Alerts
E-mail &
Registration and Call SNMP

Transfer messages SIP MessageConverter probe

to NexOSS-FC for IP packets

mirrored to probe
fraud detection. Data
Session
Border
• Calls are blocked if Inbound
Switch
Controller Call
Completed to
fraud is detected. Call Destination

TransNexus – Private and Confid

 Toll Fraud Detection Algorithm
• Call fraud risk = call termination cost
• Fraud risk of each call is rated in real time
by its termination cost.
• If the fraud scores of a call source exceed
its threshold, then calls may be blocked or
diverted.
• Fraud risk threshold is calculated for every
call source by hour of the week.

TransNexus – Private and Confid

Self Learning Fraud Thresholds
172.16.4.27 Traffic Pumping Fraud Scores 2015-11-09

Yellow trace shows

fraud threshold
calculated from
twelve weeks of
historical data

Red trace shows

actual fraud score
Blue trace shows
historical fraud score
by hour of week

TransNexus – Private and Confid

 Robocall Toolkit
• Block calls from calling numbers that
– Are listed in FCC robocall complaint database
– Are invalid, too long or too short
– Exceed normal call origination rates
• Block Wangiri calls based on fraud score
• Block calling numbers with a bad reputation.
Requires 3rd party reputation service.

• Send suspect calls to Captcha Gateway to

filter out robocalls.

TransNexus – Private and Confid

 Black / White Listing
• NexOSS includes extensive blacklisting
and whitelisting feature:
– By Called and Calling Numbers
– By Source IP addresses/Subnet/Countries
– By SIP User Agents
– API enables each subscriber to maintain
their own customized Black / White list
– Shield database maintained by TransNexus

TransNexus – Private and Confid

 ShieldSM Blacklist Database
• The ShieldSM database is
– A large and growing database of high risk calling and
called numbers, user agents and IP subnets
– A shared resource for TransNexus customers.
– Customizable by each customer.
– Updated hourly
• Shield Database sources:
Industry Groups TransNexus Customers
Advertised Premium Rate Numbers North American Number Plan
National Numbering Plans from ITU FCC Robocall Complaint List
TransNexus – Private and Confid
 Next Steps
• 2 Options for Free 30 Day Evaluation Trial:
– ClearIP Cloud based trial for 250,000 calls
– NexOSS software on customer’s servers
– Either trial includes remote support & training
• Host Server specifications for NexOSS
Calls / Hour CPU Cores RAM Disks
10,000 6 32 2 SATA
500,000 12 64 8 SAS
2,000,000 24 256 SSD

TransNexus – Private and Confid