Anti-fraud

Anti-Fraud Rules

Anti-fraud rules are accessed via main menu Alerts > Anti Fraud. Rules combat fraud and attacks, with ongoing additions. Each rule supports custom scripts for actions like firewall rules, besides email alerts. Alerts are archived in Sent Alerts.

List of Fraud/Watchdog Alerts

• Realtime concurrent calls
• SIP REGISTER flood / attack
• SIP PACKETS flood / attack
• Change CDR country
• Change REGISTER country
• Country/Continent destination
• Billing#Watchdog

Common Configuration

Shared across some rules:

• Enable hyperlinks: Makes email alert titles clickable links to rule definitions.
• IP include/exclude: Exclude IPs or networks (e.g., 10.0.0.0/8) or use IP groups.
• Suppress repeating alerts: Limit alerts to once per X hours to avoid spamming.
• Numbers include/exclude: Filter source numbers/prefixes (e.g., general rule for >10 concurrent calls, excluding specific customers).
• External script: Path to server script for execution.
• International prefixes configuration:

 ** International prefixes: Distinguish local/international calls (default: +, 00).
 ** Min international length: Numbers shorter than this are treated as local.
 ** Local numbers are in: Select country for classifying international-prefixed calls as local.

SIP REGISTER Flood/Attack

Triggers when >= N registration attempts from an IP occur in set interval.

Realtime Concurrent Calls

Tracks source IPs in realtime (not CDR-based) for concurrent calls, aiding against high-channel attacks. Parameters:

• Concurrent calls limit: Trigger on international, local, or both exceeding limits.
• Time period rules: Vary alerts by work/after hours (defined in Groups > Time Periods).

Change CDR Country

Triggers on CDR IP source changing country/continent since last call. Parameters:

• Exclude countries from alert: Whitelist countries to skip.

Change REGISTER Country

Triggers on SIP REGISTER username changing country/continent since last success. Parameters:

• Exclude countries from alert: Whitelist countries to skip.

Country/Continent Destination

Triggers on calls to specific country/continent, based on first SIP INVITE (realtime).

SIP PACKETS Flood/Attack

Triggers when >= N packets from an IP occur in set interval.

Examples of Custom Scripts

Getting Passed Arguments

Example script to log passed info:

#!/bin/bash
echo $@ >> /tmp/passed_info.txt

Use PHP json_decode($argv[4]) on 4th argument for data.

Alert Type RTP

Example to store audio on RTP alert:

#!/usr/bin/php
<?php
#var_dump($argv);
$directory='/home/alerts/audio'; #where to store audio from alerts that triggered?
$date=trim(`date '+%Y-%m-%d'`); #It will be stored to subdir date in this format YYYY-MM-DD
$guiDir='/var/www/voipmonitor'; #where is GUI installed
$destdir=$directory.'/'.$date;
`mkdir -p $destdir`;
$alert= json_decode($argv[4]);
foreach ($alert->cdr as $cdr) {
       $params = '{\"task\":\"getVoiceRecording\", \"user\": \"admin\", \"password\": \"admin\", \"params\": {\"cdrId\": "'.$cdr.'"}}';
       $command = "php $guiDir/php/api.php > $destdir/file_id_$cdr.pcap";
       exec( "echo $params | $command", $arr, $val);
}
?>

Example to block IP on remote host if > limit CDRs per caller IP:

#!/usr/bin/php
<?php
## Settings
$Limit = 19;
$blockCommand = "ssh root@pbx -p2112 ipset add blacklist";
$verbose = 1; #1 set: script will do nothing just print results, 0 set: script will do the command and print nothing to stdout
$alertsData=(json_decode($argv[4]));
#prepare string of CDRsIDs for query command
$cdrIds=$alertsData->cdr;
$out=;
foreach ($cdrIds as $id) $out .= "$id,";
$out = substr($out,0,-1);
$query="select INET_NTOA(sipcallerip),count(*) as incidents from voipmonitor.cdr where id in (".$out.") group by INET_NTOA(sipcallerip) order by incidents desc\G";
$command="mysql -h MYSQLHOST -u MYSQLUSER -pMYSQLPASS -e '$query'";
## END of settings
#call query and get results
exec($command, $arr);
#parse results
$resultip=array();
foreach ($arr as $nth => $line) {
        if (strpos($line,'INET') === FALSE) continue;
        $pos=strpos($line,":");
        $resultip[]=substr($line,$pos+2);
        $resultcnt[]=substr($arr[$nth+1],strpos($arr[$nth+1],":")+2);
}
#print ips and counts if exists and exceeded limit
if (!count($resultip)) exit;
foreach ($resultip as $n => $ip) {
        if ($resultcnt[$n] > $Limit) {
                if ($verbose) echo ("$ip : $resultcnt[$n], results in\n$blockCommand $ip\n\n");
                else exec ($blockCommand." $ip",$ar,$rc);
        }
}
?>

Alert Type Realtime Concurrent Calls

Example to block IP on concurrent calls alert:

Note: Use "By caller IP" in alert settings to pass attacker IP.

#!/usr/bin/php
<?php
#echo "DECODE PARENT INFO\n";
#print_r(json_decode($argv[2]));
#echo "DECODE RULES INFO\n";
$triggedRules = json_decode($argv[4]);
#number of tresspass of address
$IPtriggers=array();
foreach ( $triggedRules as $rule ) { //for each triggererd rule
        $keyIP = $rule->alert_info->ip; //get 'source ip which triggered rule' will used as key.
        $when = $rule->at; //get 'when this rule triggered?'
# $type = $rule->alert_info->local_international; //get type enum 'was "local" or "international" or "local & international" limits exceeded?'
# if (!isset ( $rule->alert_info->timeperiod_name )) { //get name of time-period rule which was triggered, if name isn't set its main parent rule.
# $name = "Parent rule";
# } else {
# $name = $rule->alert_info->timeperiod_name;
# }
# print "\n\nName: $name\nat : $when\nType: $type";
        if ( !isset ( $IPtriggers[$keyIP] )) {
                $IPtriggers[$keyIP] = 1;
        } else {
                $IPtriggers[$keyIP] += 1;
        }
}
#echo "\n\nShow how many rules theese Adressess triggered?\n";
#print_r ($IPtriggers);
#echo "Block all adresses that trigged any rule.\n";
foreach ( $IPtriggers as $IPKey => $nmGuilt ) {
# echo "Blocking address: $IPKey\n";
        passthru ('iptables -A INPUT -s '.$IPKey.' -j DROP', $ret);
        if ( $ret <> 0 ) {
                echo ("Problem setting firewall!\n");
                exit (1);
        }
}
?>

AI Summary for RAG

Summary: This article details VoIPmonitor's anti-fraud rules for detecting attacks like floods, concurrent calls, and country changes. It covers common configs, specific rule parameters, custom scripts for actions, and examples for RTP and concurrent calls alerts.

Keywords: anti-fraud rules, fraud alerts, watchdog, concurrent calls, SIP REGISTER flood, SIP PACKETS flood, country change, custom scripts, international prefixes, time periods

Key Questions:

• What anti-fraud rules are available in VoIPmonitor?
• How do common configurations like IP exclude or suppress alerts work?
• What triggers a SIP REGISTER flood alert?
• How does realtime concurrent calls tracking function?
• What are examples of custom scripts for alerts?
• How to configure international call detection?