SMS Inspector Product Overview

Transcription

1 SMS Inspector Product Overview Detect SMS Spam and Fraud with the passive, non-intrusive SMS Network Analyzer. Move forward with the first world-wide IMS-ready analyzer tool. 1

2 Solution Overview The SMS Inspector is a passive and non-intrusive analysis solution for potential ongoing SMS spam, faking and flooding traffic in any given mobile network. The solution is not directly integrated in the SS7 network and serves as an evaluation tool to assess the current risks and threats in the area of mobile spam and viruses. The SMS Inspector is IMS-ready. The SMS Inspector is an analysis tool that inspects incoming SMS messages for unwanted spam and potentially harmful binary viruses where the sources can then be identified and targeted for future warning or blocking by the full production core-network Intrado SMS Spam Filter product. Results generated by SMS Inspector are consistent with the AA.50 criteria defined by the GSM Association. Figure 1: The Historical Trends & Statistical Analysis (HSA) service provides a versatile and extensive interface for extracting traffic statistics and reports. The SMS Inspector receives SMS-type message feeds from an SS7 network analyzer that is typically installed in-line with the foreign SS7 traffic. The Inspector s custom-designed front-end receives message streams or data analyzer log files (TDRs/CDRs) and converts them to SCCP messages where the data is submitted to the off-network system for analysis. The inspected SMS is typically stored on a database within the platform or alternatively routed to a database within the carrier s network to provide the full reporting and analysis capabilities. 2

3 Main Benefits The primary objectives of the SMS Inspector are: Passive, non-intrusive operation Cost effective development and deployment Absolute minimal changes required to the operator s network Simple and flexible integration View what is ongoing in your network with graphical analysis Passive, non-intrusive operation The feed to the SMS Inspector does not need to receive the real traffic as the data source, nor does the traffic arriving at the SMS Inspector platform necessarily need to be in real-time. The SMS Inspector does not need to actually receive the traffic, but can receive a copy of the traffic. The copy may be a dynamic stream, or static file depending on customer requests, provided that certain characteristics of the traffic are preserved: The content of all traffic must remain unaltered and intact The timing of the arrival of traffic components towards the platform should be preserved In reality, it is encouraged that the SMS Inspector receives a real-time feed from the network as this immediate analysis can provide the most benefit to the operator. However, being able to process static files as a traffic feed offers the opportunity to perform traffic format validation in house prior to system deployment. Cost Effective Development and Deployment The SMS Inspector re-uses as far as possible all aspects of Intrado s SMS Spam Filter (SSF), providing both a cost effective development as well as analysis capabilities directly comparable to the active SS7-based SMS Spam Filter. The SMS Spam Filter is normally deployed in a high availability configuration, providing full redundancy at both the hardware and software level. To provide a cost effective deployment, the nominal hardware and software configuration can be reduced. The SMS Inspector does not need to be fully redundant in terms of both the hardware and software configuration due to the fact that it is not a critical component within the network. The SMS Inspector shall be dimensioned to provide sufficient capacity to process the expected highest throughput as a single site, non-redundant deployment. 3

4 Absolute Minimal Changes to the Operator s Network The SMS Inspector is required to be deployed with the absolute minimum of changes to the operator s network, in order to remain a cost effective, easily administrated and deployed SMS spam analysis platform. This is achieved by not introducing the SMS Inspector into the SS7 network as such, but by taking a SS7 probe traffic feed from the network as an IP-source into the SMS Inspector. The minimal network changes also imply a simple and flexible network integration of the SMS Inspector solution. SMS Spam Filtering and SMS Fraud Methodology The SMS Inspector provides the following core functionalities: SMS SMS Integrity Integrity Check Check Realtime Realtime Threshold Threshold Check Check Content Content and and Pattern Pattern Matching Matching Statistical Statistical Analysis Analysis & Historical Historical Trends Trends Hardware Complexity & Capabilities Figure 2: Modular Approach SMS Integrity Check (SIC): o Check for relation between SRI-for-SM and MT-forward-SM. o Check for discrepancies between SCCP, MAP and SM-TL layer. o Check roaming status of subscriber for incoming, external MO-forward-SM (this functionality requires an SS7 connection for the HLR interrogation). o Validate picture messages according to the TS GPP standard. o Apply basic black/white listing for originating SCCP addresses. 4

5 Real-time Threshold Check (RTC): o Count messages from originating addresses and compare to configured thresholds per remote carrier. An alarm is raised if a threshold is exceeded, or automatic blocking of messages occurs until the threshold exceeded state has cleared. Content and Pattern Matching (CPM): o Validate SMS parameters against content and pattern rules. Historical Trend & Statistical Analysis (HSA): o Utilizes a history database to detect patterns (e.g. IMSI fishing, detection of potential spam). o Utilizes a history database to produce various reports for later analysis. Optionally, the SMS Inspector can be extended to support outbound roaming checks by connecting it to the live SS7 network during the spam analysis phase in order to perform HLR queries. If desired, the SMS Inspector can be configured to accept and review a copy of all SMS received via IP from third-party applications. 5

6 SMS Inspector characteristics The abstraction layer used by the SMS Inspector enables different traffic formats to be accommodated with minimal development effort, as long as the traffic satisfies the base criteria of retaining all MAP parameters, unaltered, and preserving the timing characteristics of the traffic. This IP based approach allows the SMS Spam Filtering Platform (SSF) product line to be IMSready, i.e. easy to fit into an IMS environment where the applications and services are more neatly located on an application level and the application/service session execution is left up to specific protocols like SIP and Diameter. The IP abstraction of the SMS Inspector enables the active, blocking SMS Spam Filter services to remain future proof to customers who decide to evolve their network towards IMS, the de-facto next telecommunications standard. The SMS Inspector does not need to be fully redundant in terms of both the hardware and software configuration as it is outside of live network traffic. It can be dimensioned to provide sufficient capacity to process the expected highest throughput as a single site, non-redundant deployment. IP integration negates the need for SS7 cards and the deployment of an SS7 stack, with associated cost savings. This point implies that the feed to the SMS Inspector does not need to receive the real traffic as the data source, nor does the traffic arriving at the SMS Inspector platform necessarily need to be in real-time. If the content of all traffic remains unaltered and intact, the timing of the arrival of traffic components towards the platform is preserved. Summing up, SMS Inspector key factors are: Passive, non-intrusive operation Cost effective development and deployment Absolute minimal changes required to the operator s network Simple and flexible integration GSMA SMS fraud and spam criteria are all catered for Remember that the funding for this specific free trial is covered completely by Intrado. 6

7 Positioning the solution in the MNO network If the participating operator accepts that spam threats may come from other networks and assumes that its own network is spam safe, then the interconnection to other networks should be taken into consideration. As it is most likely that spam threats come from other interconnected networks, and many spam checks are played/initiated based on the analysis of SRI_SM and MT_FW_SM, probes should be positioned wherever such a messaging flow comes in according to interconnection agreements and routing plans. Typically, signalling gateways, (national and/or international), are the better places to collect data to feed SMS Inspector. In some cases, also MO_FW_SM traffic is significant, for example when such traffic is initiated by users in an ``outbound`` roaming state (i.e. local MNO subscribers temporarily roaming in other AA.19-compliant networks). SMS Inspector is also able to spot abnormalities in this scenario and the related signalling probe should be positioned wherever this traffic enters the network which is most probably the national/international gateway where SMS-related MAP signalling is available in accordance with the operator`s routing plan. Intrado recommends the following implementation approach: Phase 1 Potential Extension: Phase 2 Potential Extension: Phase 3 Potential Extension: Phase 4 Objective Analyse and Inspect Passive network integration Active filtering and alarming Level 1 threats Active filtering and alarming Level 2 threats Level 3 threats Revenue generating services Result Clear picture and statistics of spam risks. Reports with Spoofing, Faking, Phishing or Virus statistics Level one threats are minimized through active filtering and alarming. For example: Filtering and alarming on foreign network traffic and outbound roamers (spoofing source). Level two threats are minimized. For example: Filtering also on home network traffic and IP traffic (applications connected to gateways and/or SMSC/MMSC infrastructure. Level three threats are minimized. Additional revenue generating services such as: forwarding, copying, virtualizing, storing, rerouting, intercepting, etc. Figure 3: Phased Approach 7

8 The SMS Inspector and the active, blocking SMS Spam Filter are deployed on the same hardware platform for the duration of the inspection service. Once the inspection is complete and the active, blocking SMS Spam Filter is brought on-line to intercept all incoming SMS messages, the probe TDR/CDR interface is removed and replaced by a direct connection to the SS7 network. The HLR/MSC proxies inspect various message types (SRI-SM, FWSM-MO, FWSM-MT, RSDS) in real-time. SMS Inspector analysis modes Intrado is pleased to propose a two-mode approach to SMS Inspector features and benefits. Option A) Traffic files Data file produced by existing network probe to be analyzed remotely by the SMS Inspector. In the case where data files are to be analysed remotely no HW/SW onsite integration is required. A pre-check of the file format and file content is all that is necessary to participate in the trial in this way to ensure that SMS Inspector can open and analyze the files. In this case, the operator sends Intrado a data file taken from any interface they prefer to analyze, and Intrado will provide the operator with a detailed report after running the checks on an internal, dedicated SMS Inspector chain. Option B) Integration with network probes IP data stream from network probes to be analyzed in near real time by the locally installed SMS Inspector In this case, IP integration with the existing probe is necessary but no SS7 HW is required. The same technical data exchange is required as per option A) to validate the readability and format consistency of the data. The integration effort is approximately one week onsite. In this case, the operator is likely to reuse existing SS7 probes within the network that they wish to analyze and allow Intrado to install SMS Inspector. The integration of the SMS Inspector is simplified greatly by the fact that it is not required to provide a full SS7 integration, but simply receive the MAP operations as an IP stream, which shall then be near real time, continuously analyzed by SMS Inspector. The IP stream can be provided by the deployment of one or more SS7 network probes. We have experience in analyzing data from various probe vendors. In both cases, as a preparatory step prior to the study, the operator shall provide a sample of the traffic that the SMS Inspector has to analyze. If Option B is chosen, integration (IP, passive, non-intrusive) is necessary. A proposed configuration is as follows on the next page. 8

9 Reporting Results The SMS Inspector stores the results of SMS spam analysis in a history database (for more information see chapter Reporting Results ) either internal or external within the operator s own network environment. The history database is used to generate reports that are flexibly defined as SQL based queries. The outcome of the report is presented to the operator in graphical and tabular formats. All raw traffic analyzed from the SMS Inspector is available in CSV format for further analysis according to the operator preferences. Standard analysis reports include, but are not limited to, the following reports that can be displayed as a statistical window representing a period of 12 hours, 1 day, 1 week, and 1 month. All of the standard reports can be used as a basis for developing customized reports and the SMS Inspector also allows custom SQL queries to be defined. Please see the list below for an overview of the available reports. Standard and Customizable Reports Top lists of operators generating the most traffic Top lists of SCCP OAs overall Top lists of SCCP OAs per operator Distribution of message types, SRISM, MO-FWSM, MT-FWSM, overall Distribution of message types, SRISM, MO-FWSM, MT-FWSM, per operator Distribution of message types, SRISM, MO-FWSM, MT-FWSM, per SCCP OA Distribution of sms traffic sources per operator (all operators in one table) Distribution of sms traffic sources per SCCP OA (all SCCP OAs in one table) Distribution of rules hit in the CPM service (all rules in one table) Traffic trend per operator (specific operator(s)) Traffic trend per SCCP OA (specific SCCP OA(s)) Traffic trend per filtering rule (specific rule(s)) Figure 4: List of Current Standard Reports The SMS Inspector analysis reporting enables the operator to identify acceptable trends and anomalies that may indicate sources of SMS spam. The following screen shot shows a report from the Historical Trend and Statistical Analysis service, illustrating the distribution of SMS categories (how the messages would have been 9

10 actively processed according to the filtering service outcomes accept, warn or block ) over a 1 hour period. Figure 5: Graph of the distribution of actions on SMS traffic over 1 hour Results generated by SMS Inspector are consistent with the AA.50 criteria defined by the GSM Association. Any findings made during the SMS Inspector analysis phase of a deployment can be used to: identify networks acting as sources of spam and allow the victim operator to act accordingly (review interconnection agreements/aa.19 agreement etc.) enable the proper addressing of complaints against offending operators through, and in compliance with the GSM Association s defined process provide invaluable information which can be used to optimise the efficiency of any SMS spam filter solutions that could be deployed subsequently Together with statistics, tables and graphs, Intrado shall also provide the operator with observations and recommendations on the submitted findings. 10

11 In the following section, the results made available by the analysis tool are described in detail and the data presented relates to a real anti-spam trial Intrado has previously performed. Stat 1: total traffic Criteria addressed: Difference SRI_SM/MT_FW_SM to identify phishing; Incorrect carrier/operator link set; Abnormal load What to look for: ratio between SMS-related operations usually have a steady trend; abnormal spikes may indicate spam Stat 2: Counting SMS by foreign SMSC Criteria addressed: Flooding What to look for: specific SMSCs sending abnormal amounts of traffic is suspect 11

12 Stat 3: filtering data Criteria addressed: Flooding; Faking (own address), Spoofing; offensive or inappropriate message content What to look for: message content, result of filtering rules at different levels Stat 4: observation of ``Unknown subscriber`` Criteria addressed: Faking What to look for: a relatively high number of unknown subscriber MAP error messages could be an indication of faking Stat 5: observation of illogical address field Criteria addressed: Spoofing What to look for: if particular numbers/ranges are not as expected Example: we implemented rules for checking addresses of less than 10 digits. These rules have been applied to MT_FWSM and the relevant address fields are SCCP_OA, MSISDN_OA and SC_OA. 12

13 For MSISDN, in a particular case there were 3,945,194 MT_FWSM messages where the MSISDN address was composed of less than 10 digits. We noted that this can also be due to services with alphanumeric MSISDNs. For SCCP_OA, there were 70,761 MT_FWSM messages that had the SCCP_OA address composed of less than 10 digits. For SC_OA, there were 8,483 MT_FWSM messages that had the SC_OA address composed of less than 10 digits. Stat 6: Detection of Elevated MO_SM by Out-bound Roamers Criteria addressed: spoofing What to look for: high number of MO_SM originating from out-bound roamers where the MSISDN indicates a local subscriber and the SCCP_OA is the address of an MSC in a foreign network Stat 7: Detection of spoofing Criteria addressed: spoofing What to look for: inconsistent message structure at different layers 13

14 Invalid: User data Header Service (UHS) indicates a protocol violation of the content (i.e. picture message that has the wrong number of octets in the length field). SCCP_ Inconsistent: discrepancy between SCCP_OA (SCCP) and SC_OA (MAP). SMSTL_Inconsistent: discrepancy between SCCP_OA (SCCP) and MSISDN_OA (SMS_TL). ThresholdBlock: Real-time Threshold Checking service (RTC) warns all the messages coming from specific sources (or from all sources (SCCP_OA)) if the amount of traffic from such sources exceeds a determined threshold. Stat 8: Detection of non-correlated SRI_SM and MT_FW_SM Criteria addressed: spoofing What to look for: ensure that all MT_FWSM have a corresponding SRI_SM and that the SCCP addresses used are identical over a defined prefix 14

15 About Intrado Now in its 27th year, Intrado continues to consistently deliver quality products and services to support location technologies, database management, mobility services, intercarrier information management, and notification services. Intrado s ability to demonstrate financial stability and remain profitable recently resulted in the acquisition of Intrado by West Corporation. On April 4, 2006, Intrado became a wholly owned subsidiary of West Corporation. As such Intrado is no longer a separate entity on the Nasdaq stock exchange. West Corporation West Corporation is the nation s premier provider of outsourced communication solutions, specializing in customer acquisition, customer care, and interactive voice response services, as well as conferencing and collection services. Intrado can now leverage the vast resources available through West to help Intrado s clients communicate more effectively and maximize the value of Intrado s customer relationships. Intrado's affiliation with West represents a bright future, rich with unlimited technological growth and the ability to continue to expand Intrado s commercial interests. To maintain continued financial growth West focuses on the delivery of quality products and services and unparalleled customer care, key elements in winning new business and retaining existing clientele. Shortly after its acquisition of Intrado, West acquired Raindance Communications Inc. a Colorado-based leader in integrated multimedia conferencing services and support. West, headquartered in Omaha, Nebraska, has a team of more than 29,000 employees based in North America, Europe, and Asia. West processes more than 20 billion minutes of telephonyrelated transaction time for today's leading companies each year. In addition, industry experts have recognized West Corporation as one of the nation's top providers of outbound, interactive and inbound services. 15

16 Intrado International Two years ago, Intrado acquired bmd wireless AG. This move enhanced Intrado s international footprint, as well as its wireless growth strategy. Founded in 1994, bmd wireless is a Swiss based company that develops core network software products for wireless operators and service providers and offers related implementation, operation and maintenance services. bmd wireless AG is the legal entity of Intrado in Switzerland. Intrado s and bmd s combined key facts include: Worldwide 750 highly specialized employees with expertise in SS7 and call routing Financially sound - profitable and cash flow positive Local presence in the US, Switzerland, Romania, Singapore and China Intrado offers development, implementation and support services to exceed customer needs. To complement its solution and product offerings, Intrado provides comprehensive implementation and development services, that: Enable wireless operators and service providers to quickly deploy new value added services and increase speed, reliability and cost effectiveness Intrado offers 7 x 24 global support services and local on-site assistance through longstanding partnerships Intrado is an integral partner in designing, planning, developing and deploying customized solutions Intrado is the core network infrastructure company that powers many emerging services in the wireless market such as Microsoft's pan-european launch of mobility services (Hotmail and MSN Messenger ), mobile marketing campaigns for companies such as Coca-Cola or Nestlé and two-way interactive TV for some of Europe's largest media companies. For more information, please visit info@intradoemea.com Phone: +41 (0) Fax: +41 (0)