Hi all,
The second topic discussed during the last IRC meeting[1] was about
building a Fraud Detection module that prevents PBX or accounts hijacking.
Basically the module will allow you to define different dialing profiles
(the destination you are dialing, how often, how many parallel calls,
etc.) - the profiles are statically defined via DB. Such profile is
assigned to a dialing entity (end-user, SIP trunk, inbound gateway,
etc.). These metrics can be further interpreted to block or allow
certain suspicious calls from that entity.
The module will export a new command in the OpenSIPS script that can be
used to check whether the call should be allowed or not. The command
will return different error codes, depending on the severity: 1 for the
normal state (call should be allowed, no abnormalities detected), -1 for
warning (user is approaching to a critical limit) and -2 for critical
(thresholds are reached, call should not be allowed). A usage example
might be something like this:
if (check_fraud("$rU", "$fU", "premium") < 0) {
switch($retcode) {
case -1:
xlog("WARNING: $fU called to $rU\n");
break;
case -2:
xlog("CRITICAL: $fU called to $rU - call denied\n");
send_reply("403", "Forbidden");
exit;
}
}
Moreover, the module will also trigger events (that can be handled by
event_routes or external applications) whenever those thresholds are
reached.
The discussion was not closed during the meeting, so we need to gather
more ideas for the Fraud Detection module. What kind of features would
you like to see in this module? What use case scenarios you find
suitable for fraud detection? How would you like to use this feature?
Feel free to give any feedback you find useful for this!
[1] http://www.opensips.org/Community/IRCmeeting20140827
Best regards,
--
Răzvan Crainea
OpenSIPS Solutions
www.opensips-solutions.com
_______________________________________________
Users mailing list
[email protected]
http://lists.opensips.org/cgi-bin/mailman/listinfo/users
