Anti-fraud: Difference between revisions

From VoIPmonitor.org
(Rewrite: cleaner structure, added diagram, consolidated content)
 
(32 intermediate revisions by 3 users not shown)
Line 1: Line 1:
Anti-fraud rules are in main menu Alerts / Anti fraud. We are continuously adding more rules to combat fraud / attacks and as of now you can use following rules. Each fraud alert also implements custom script which can be used to automatically run firewall rule or any action you like besides the standard email alert. Each alert is also archived in Sent alerts.
{{DISPLAYTITLE:Anti-Fraud Detection}}
[[Category:Configuration]]
[[Category:Alerts]]


= List of fraud alerts =
= Anti-Fraud Detection =


* Realtime concurrent calls
VoIPmonitor provides GeoIP-based anti-fraud alerts to detect toll fraud, account hijacking, and brute-force attacks.
* SIP REGISTER flood / attack
* SIP PACKETS flood / attack
* change cdr country
* change register country
* country/continent destination


= Some fraud rules have common configuration =
<kroki lang="mermaid">
%%{init: {'flowchart': {'nodeSpacing': 15, 'rankSpacing': 30}}}%%
flowchart LR
    subgraph Detection
        A[CDR/Register Data] --> B{GeoIP Lookup}
        B --> C[Country/IP Analysis]
    end
    subgraph Alert Types
        C --> D[Country Destination]
        C --> E[CDR Country Change]
        C --> F[Register Country Change]
        C --> G[Sequential Pattern]
        C --> H[Failed Register]
    end
    subgraph Response
        D & E & F & G & H --> I[Email Alert]
    end
</kroki>


== Configuration ==


* Enable hyperlinks - in the email alert the title will be html hyperlink which transfer you to rule definition
All anti-fraud alerts are configured in '''GUI → Alerts → Anti Fraud'''.
* IP include/exclude - you can exclude some list of IP addresses or IP networks (ex.: 10.0.0.0/8) or you can use IP groups and select it.
* suppress repeating alerts - to prevent spamming you from repeating alerts you can limit that the rule will sent alert only once per X hours.
* Numbers include/exclude - by default there is no tel. number filter and you can exclude some source number / prefixes. For example you want to have one general rule to be alerted if any IP will have more than 10 concurrent calls expect for some customer with some numbers.  


* external script - path to the script on the server which will be executed.  
{{Note|1=Anti-fraud features require GeoIP configuration. See [[#GeoIP Integration|GeoIP Integration]] below.}}


#!/usr/bin/php
== Alert Types ==
<?php
#echo "DECODE PARENT INFO\n";
#print_r(json_decode($argv[2]));
#echo "DECODE RULES INFO\n";
$triggedRules = json_decode($argv[4]);
#number of tresspass of address
$IPtriggers=array();
foreach ( $triggedRules as $rule ) {                            //for each triggererd rule
#      $keyIP = $rule->alert_info->ip;                        //get 'source ip which triggered rule' will used as key.
        $when = $rule->at;                                      //get 'when this rule triggered?'
#      $type = $rule->alert_info->local_international;        //get type enum 'was "local" or "international" or "local & international" limits exceeded?'
#      if (!isset ( $rule->alert_info->timeperiod_name )) {    //get name of time-period rule which was triggered, if name isn't set its main parent rule.
#              $name = "Parent rule";
#      } else {
#              $name = $rule->alert_info->timeperiod_name;
#      }
#      print "\n\nName: $name\nat  : $when\nType: $type";
        if ( !isset ( $IPtriggers[$keyIP] )) {
                $IPtriggers[$keyIP] = 1;
        } else {
                $IPtriggers[$keyIP] += 1;
        }
}
#echo "\n\nShow how many rules theese Adressess triggered?\n";
#print_r ($IPtriggers);
#echo "Block all adresses that trigged any rule.\n";
foreach ( $IPtriggers as $IPKey => $nmGuilt ) {
#      echo "Blocking address: $IPKey\n";
        passthru ('iptables -A INPUT -s '.$IPKey.' -j DROP', $ret);
        if ( $ret <> 0 ) {
                echo ("Problem setting firewall!\n");
                exit (1);
        }
}
?>


=== Country/Continent Destination ===


* international prefixes configuration
Real-time detection of calls to specific countries or continents. Primary use case: detecting toll fraud where compromised accounts make expensive international calls.
** international prefixes - to distinguish between local and international calls you have to add here list of prefixes. Default are +, 00
** min international length - if destination number is less then this value it will be not treated as international but local.
** local numbers are in - select the country to which local calls belongs. This will allow to classify calls with international prefix as a local number.


= SIP REGISTER flood / attack
'''Configuration:'''
* Select target countries/continents to monitor
* Set threshold for number of calls
* Configure notification recipients


Alert is triggered when sniffer detects >= N number of registration attempts from some IP during set interval.
=== Change CDR Country ===


= Realtime concurrent calls =
Detects when the IP country of caller or callee changes between calls - indicates potential account compromise or SIP credential theft.


This anti-fraud rule (and the purpose is not only for fraud) works in realtime and it is not based on CDR. It tracks each source IP and count number of concurrent call. The advantage of tracking concurrent calls in realtime and not based on CDR is obvious and it helps to compete attacks which creates many channels at the same time with long duration. You can set this parameters:
'''Configuration:'''
* Whitelist trusted countries (Exclude countries field)
* Apply filters by phone numbers or IP addresses


* Concurrent calls limit - You can choose to trigger alert only if international calls is over the limit or only local calls or both calls.
=== Change REGISTER Country ===
* Time period rules - you can limit that the alert will work differently during work hours and after hours. Time periods are defined in Main menu -> Tools -> Time periods


= change cdr country =
Detects device registration from unexpected countries - strong indicator of credential theft or account hijacking.


Alert is triggered when the last CDR changes IP source which is in different country or continent since last call. You can set this parameters:
'''Example:''' User normally registers from Germany but suddenly registers from Russia → alert triggers.


* Exclude country form alert: you can whitelist certain countries which will not trigger the alert.
=== Fraud: Sequential ===


= change register country =
Detects high-volume sequential calling patterns to destination numbers within a time window.


Alert is triggered when the last SIP REGISTRATION for some username changes country or continent since last successful registration. 
{| class="wikitable"
|-
! Parameter !! Description !! Example Values
|-
| '''interval''' || Time window (seconds) for counting calls || 600 (10 min), 3600 (1 hour)
|-
| '''limit''' || Max calls allowed before alert triggers || 50, 100, 500
|-
| '''number field''' || Target destination number (leave empty for ANY) || Empty or specific number
|}


* Exclude country form alert - you can whitelist certain countries which will not trigger the alert.
{{Warning|1='''Critical:''' Leave the number field '''empty''' to monitor ALL destination numbers. The alert fires when ANY single destination exceeds the limit within the interval.}}
= country/continent destination =
 
Alert is triggered when someone is calling to specific country or continent. This alert is based on first SIP INVITE and not from CDR thus it works in realtime.
'''Configuration Steps:'''
= SIP PACKETS flood attack =
# Navigate to '''GUI → Alerts → Anti Fraud'''
Alert is triggered when sniffer detects >= N number of packets from some IP during set interval.
# Create new alert with type '''Fraud: sequential'''
# Set '''interval''' (e.g., 600 for 10 minutes)
# Set '''limit''' (e.g., 100 calls)
# '''Leave number field empty''' to apply to ANY number
# Configure recipient email
# Save
 
'''Example Configurations:'''
 
{| class="wikitable"
|-
! Scenario !! interval !! limit !! number field
|-
| >100 calls to any number in 10 min || 600 || 100 || Empty
|-
| >500 calls to any number in 1 hour || 3600 || 500 || Empty
|-
| >50 calls in 5 min (high-volume attack) || 300 || 50 || Empty
|-
| Monitor specific premium number || 1800 || 200 || Specify number
|}
 
{{Tip|1='''Fraud: sequential vs concurrent calls:''' Sequential alerts count total calls over a time window. Concurrent alerts detect simultaneous active calls at one moment. Use sequential for detecting volume spikes, concurrent for capacity monitoring.}}
 
=== SIP Failed Register ===
 
Detects brute-force and credential stuffing attacks by monitoring failed registration attempts.
 
{| class="wikitable"
|-
! Parameter !! Description
|-
| '''threshold''' || Maximum failed attempts before alert
|-
| '''interval''' || Time window (seconds) for counting attempts
|}
 
== GeoIP Integration ==
 
Anti-fraud alerts require GeoIP for IP-to-country resolution.
 
'''Configuration:''' GUI → Settings → System Configuration → GeoIP
 
'''Processing priority (fallback mechanism):'''
# MaxMind API (commercial, highest accuracy)
# IPInfoDB API
# Local GeoIP database (GeoIPCity.dat or MySQL tables)
# Free portals (backup)
 
For detailed GeoIP configuration, see [[Order_of_GeoIP_processing]].
 
== Best Practices ==
 
* '''Toll fraud prevention:''' Configure Country/Continent Destination alerts for premium rate countries
* '''Account protection:''' Enable Change REGISTER Country for all critical accounts
* '''Brute-force protection:''' Set SIP Failed Register with low threshold (e.g., 10 attempts in 60 seconds)
* '''Volume monitoring:''' Use Fraud: sequential with empty number field to catch attacks on any destination
* '''Granular control:''' Combine with [[Groups|IP Groups]] for provider-specific monitoring
 
== See Also ==
 
* [[Alerts]] - General alert configuration and email setup
* [[Order_of_GeoIP_processing]] - GeoIP configuration details
* [[Groups]] - IP and telephone number groups for filtering
* [[Register]] - SIP registration monitoring
 
== AI Summary for RAG ==
 
'''Summary:''' VoIPmonitor anti-fraud detection guide using GeoIP-based alerts. Alert types: (1) Country/Continent Destination - real-time detection of calls to specific countries for toll fraud prevention; (2) Change CDR Country - detects IP country changes between calls indicating account compromise; (3) Change REGISTER Country - detects registration from unexpected countries indicating credential theft; (4) Fraud: sequential - detects high-volume calling patterns using interval (time window in seconds) and limit (max calls) parameters, CRITICAL: leave number field empty to monitor ALL destination numbers; (5) SIP Failed Register - detects brute-force attacks via failed registration monitoring. Configuration path: GUI → Alerts → Anti Fraud. Requires GeoIP configuration (Settings → System Configuration → GeoIP) with MaxMind API as highest priority.
 
'''Keywords:''' anti-fraud, toll fraud, fraud detection, GeoIP, country alert, Change CDR Country, Change REGISTER Country, Fraud sequential, interval, limit, number field empty, SIP failed register, brute-force, credential stuffing, account hijacking, premium rate numbers, sequential pattern detection, call volume monitoring
 
'''Key Questions:'''
* How do I configure anti-fraud alerts in VoIPmonitor?
* How do I detect toll fraud in VoIPmonitor?
* What is the Fraud: sequential alert and how do I configure it?
* How do I detect high volume calls to any destination number?
* Should I leave the number field empty in Fraud: sequential?
* What is the difference between Fraud: sequential and concurrent calls alerts?
* How do I detect account hijacking in VoIPmonitor?
* How do I configure alerts for international calls?
* What is the Change REGISTER Country alert?
* How do I detect brute-force attacks on SIP registration?
* How does VoIPmonitor use GeoIP for fraud detection?

Latest revision as of 16:47, 8 January 2026


Anti-Fraud Detection

VoIPmonitor provides GeoIP-based anti-fraud alerts to detect toll fraud, account hijacking, and brute-force attacks.

Configuration

All anti-fraud alerts are configured in GUI → Alerts → Anti Fraud.

ℹ️ Note: Anti-fraud features require GeoIP configuration. See GeoIP Integration below.

Alert Types

Country/Continent Destination

Real-time detection of calls to specific countries or continents. Primary use case: detecting toll fraud where compromised accounts make expensive international calls.

Configuration:

  • Select target countries/continents to monitor
  • Set threshold for number of calls
  • Configure notification recipients

Change CDR Country

Detects when the IP country of caller or callee changes between calls - indicates potential account compromise or SIP credential theft.

Configuration:

  • Whitelist trusted countries (Exclude countries field)
  • Apply filters by phone numbers or IP addresses

Change REGISTER Country

Detects device registration from unexpected countries - strong indicator of credential theft or account hijacking.

Example: User normally registers from Germany but suddenly registers from Russia → alert triggers.

Fraud: Sequential

Detects high-volume sequential calling patterns to destination numbers within a time window.

Parameter Description Example Values
interval Time window (seconds) for counting calls 600 (10 min), 3600 (1 hour)
limit Max calls allowed before alert triggers 50, 100, 500
number field Target destination number (leave empty for ANY) Empty or specific number

⚠️ Warning: Critical: Leave the number field empty to monitor ALL destination numbers. The alert fires when ANY single destination exceeds the limit within the interval.

Configuration Steps:

  1. Navigate to GUI → Alerts → Anti Fraud
  2. Create new alert with type Fraud: sequential
  3. Set interval (e.g., 600 for 10 minutes)
  4. Set limit (e.g., 100 calls)
  5. Leave number field empty to apply to ANY number
  6. Configure recipient email
  7. Save

Example Configurations:

Scenario interval limit number field
>100 calls to any number in 10 min 600 100 Empty
>500 calls to any number in 1 hour 3600 500 Empty
>50 calls in 5 min (high-volume attack) 300 50 Empty
Monitor specific premium number 1800 200 Specify number

💡 Tip: Fraud: sequential vs concurrent calls: Sequential alerts count total calls over a time window. Concurrent alerts detect simultaneous active calls at one moment. Use sequential for detecting volume spikes, concurrent for capacity monitoring.

SIP Failed Register

Detects brute-force and credential stuffing attacks by monitoring failed registration attempts.

Parameter Description
threshold Maximum failed attempts before alert
interval Time window (seconds) for counting attempts

GeoIP Integration

Anti-fraud alerts require GeoIP for IP-to-country resolution.

Configuration: GUI → Settings → System Configuration → GeoIP

Processing priority (fallback mechanism):

  1. MaxMind API (commercial, highest accuracy)
  2. IPInfoDB API
  3. Local GeoIP database (GeoIPCity.dat or MySQL tables)
  4. Free portals (backup)

For detailed GeoIP configuration, see Order_of_GeoIP_processing.

Best Practices

  • Toll fraud prevention: Configure Country/Continent Destination alerts for premium rate countries
  • Account protection: Enable Change REGISTER Country for all critical accounts
  • Brute-force protection: Set SIP Failed Register with low threshold (e.g., 10 attempts in 60 seconds)
  • Volume monitoring: Use Fraud: sequential with empty number field to catch attacks on any destination
  • Granular control: Combine with IP Groups for provider-specific monitoring

See Also

AI Summary for RAG

Summary: VoIPmonitor anti-fraud detection guide using GeoIP-based alerts. Alert types: (1) Country/Continent Destination - real-time detection of calls to specific countries for toll fraud prevention; (2) Change CDR Country - detects IP country changes between calls indicating account compromise; (3) Change REGISTER Country - detects registration from unexpected countries indicating credential theft; (4) Fraud: sequential - detects high-volume calling patterns using interval (time window in seconds) and limit (max calls) parameters, CRITICAL: leave number field empty to monitor ALL destination numbers; (5) SIP Failed Register - detects brute-force attacks via failed registration monitoring. Configuration path: GUI → Alerts → Anti Fraud. Requires GeoIP configuration (Settings → System Configuration → GeoIP) with MaxMind API as highest priority.

Keywords: anti-fraud, toll fraud, fraud detection, GeoIP, country alert, Change CDR Country, Change REGISTER Country, Fraud sequential, interval, limit, number field empty, SIP failed register, brute-force, credential stuffing, account hijacking, premium rate numbers, sequential pattern detection, call volume monitoring

Key Questions:

  • How do I configure anti-fraud alerts in VoIPmonitor?
  • How do I detect toll fraud in VoIPmonitor?
  • What is the Fraud: sequential alert and how do I configure it?
  • How do I detect high volume calls to any destination number?
  • Should I leave the number field empty in Fraud: sequential?
  • What is the difference between Fraud: sequential and concurrent calls alerts?
  • How do I detect account hijacking in VoIPmonitor?
  • How do I configure alerts for international calls?
  • What is the Change REGISTER Country alert?
  • How do I detect brute-force attacks on SIP registration?
  • How does VoIPmonitor use GeoIP for fraud detection?
Retrieved from "https://www.voipmonitor.org/doc/index.php?title=Anti-fraud&oldid=10024"