Subex Fraud Management System version 8 on the IBM PureFlex System

Transcription

1 Subex Fraud Management System version 8 on the IBM PureFlex System A fraud management solution for today s dynamic market place Subex IBM Systems and Technology Group ISV Enablement April 2012 Copyright IBM Corporation, 2012

2 Table of contents Abstract...1 Introduction...1 Fraud Management architecture... 2 Test environment topology...3 Physical component layout... 4 PureFlex System internal management network... 5 Logical components and data networks... 5 KVM setup and configuration... 6 Application Server Application Server Database Server... 7 Storwize V7000 Unified SAN storage... 7 Data virtual LAN (VLAN)... 8 PureFlex System advantage... 8 Test process...9 Rule processing 100% participation for one aggregation... 9 Rule processing scalability for multiple aggregations... 9 Test results...9 Intel node configuration / tuning... 9 Kernel configurations... 9 Oracle configurations Storwize V7000 Unified configuration / tuning BNT switch configuration QLogic switch configuration Rule processing 100% participation for one aggregation results Rule processing scalability for multiple aggregation results Summary...12 Resources...13 Trademarks and special notices...14

3 Abstract This paper describes the testing done with the Subex ROC Fraud Management System solution running on the IBM PureFlex System. ROC Fraud Management is built to drive fraud prevention by eliminating known frauds, uncovering new fraud patterns, minimizing fraud run time, augmenting internal controls, and supporting continuous fraud management process improvement. ROC Fraud Management detects known fraud types and patterns of unusual behavior, helps investigate these unusual patterns for potential fraud, and uses the knowledge, thus generated, to upgrade and protect against future intrusions. The solution is characterized by its unique architecture that harnesses the power of proven rules-based alarms and pattern matching driven by advanced statistical techniques. Adding power to this hybrid detection system is a set of potent case management tools. These tools provide relevant case data that are made easily accessible through a single window in a fast web-based GUI. The IBM PureFlex System is a tight integration combination of compute nodes, storage, networking, and system management all in one package. This hardware platform is a more integrated, flexible and open computing system across all resources that is dynamically managed from a single vantage point to maximize efficiency. The integration of the Subex solution on the IBM PureFlex System results in a tightly integrated solution to meet the needs of today s service providers. Introduction Operators across the world are moving towards delivering diverse, high-margin services in the nextgeneration environment. Exposure to complex types of next-generation fraud might increase dramatically for network operators depending on their business model. Fraud risks might be greater for operators having a high-value service offering. Not only must operators be shielded against the newly emerging frauds that accompany these services, but the approach to fraud management must evolve to guard against today's fraudsters: more intelligent and shrewder with intentions and means to cause considerable damage to network operators. The high flexibility of ROC Fraud Management allows operators of different sizes to customize rules to suit unique network and business requirements. A configurable workflow management tool integrates the investigation process with detection. ROC Fraud Management has the ability to detect fraud types in all telecom environments: Wireline (public switched telephone network (PSTN), Internet service provider (ISP), and Voice over Internet Protocol (VoIP)), and wireless (2G, 2.5G, 3G); and across all services: postpaid, payment, value-added service (VAS), Multimedia Messaging Service (MMS), and M-commerce. ROC Fraud Management provides the following benefits. Provide future proof-detection techniques Guard against habitual offenders Ensure that prepaid service is truly risk free Launch profitable IP-based services 1

4 This white paper takes a deep look at how the Subex ROC Fraud Management solution is integrated on the IBM PureFlex System platform. It describes the tests that were run, optimizations implemented, and results observed. Fraud Management architecture The following figure shows the Fraud Management architecture. Figure 1: Fraud Management architecture 2

5 Data source: A data source is a module that takes a stream of files containing raw call detail records (CDRs) as input, performs necessary lookups, eliminates unwanted fields from the CDR, and writes the output records which contain fields relevant to the Nikira application to an output file. Record Dispatcher: The primary function of the Record Dispatcher module is to distribute CDRs in modulo fashion to various record processors for processing. This is a multithreaded process with each child thread feeding one record processor. Record Processor: The primary function of the Record Processor is to apply the various rules configured in the system on an incoming CDR and check for any fraudulent activity. If any rule threshold is violated, a request is sent to the alarm generator module to generate alarm for the subscriber pertaining to that CDR. The Record Processor is a multithreaded module which has filter threads, counter threads, counter manager receiver threads, and violation threads. DBWriter: DBWriter is responsible for preparing the CDR data to be eligible to get loaded into the database. For late CDRs, this module does the insertion into the CDR tables. Record File Loader: Record File Loader loads the CDRs into the database. Smart Pattern Processor: Smart Pattern Processor generates an alarm if a sequence of events occurs. Alarm Generator: Alarm Generator is responsible for generation of alerts and alarms when a rule threshold is violated. Counter Manager: Counter Manager is responsible for the aggregation part of the rule engine and has a in-memory aggregation framework for retrieving the cumulative information for a particular subscriber on behalf of record processor. This is also a multithreaded process with has receiver threads, slave threads, and sender thread. Test environment topology The integrated design of the PureFlex System starts with a single rack capable of holding up to 14 nodes. Those nodes can be any combination of Intel and IBM POWER nodes. In addition, built into the PureFlex System rack are switches for Ethernet and Fibre Channel (FC) connectivity with the outside environment. The PureFlex System is designed for full redundancy which allows for multiple switches, fans, and power supplies to assure that there is no single point of failure. Multiple PureFlex System racks can be combined to satisfy growth and larger configuration requirements. 3

6 Physical component layout The PureFlex System used for the Subex testing used two compute nodes. Both the nodes are Intel nodes with 16 cores, Intel Xeon processors E at 2.70 GHz. One compute node had 24 GB memory and the second node had 64 GB memory. The Ethernet switch integrated in the chassis is a BNT 10 Gb scalable switch with 20 external ports. The compute node has an integrated internal connection to the switch. This switch is used to create multiple virtual Ethernet networks to isolate the TCP/IP traffic. The FC switch integrated in the chassis is a 20-port QLogic 8 Gb scalable switch. The compute nodes have an integrated internal connection to the switch. This switch allows for external connection to storage, such as the IBM Storwize V7000 Unified storage system. The IBM Storwize V7000 Unified system is connected directly to the PureFlex System FC switch using a 4Gb FC with 1 port enabled. For this Subex test, the test team used 3 TB of SAN disk capacity. This storage was configured into four file systems to support the testing. The PureFlex System chassis management module, also called the CMM, provides management capabilities of all the elements in the chassis which include the IBM POWER7 compute node and the network switches. From the CMM, it is possible to perform operations such as assigning IP addresses to the internal nodes. The CMM provides a secure management network for administration of the components in the PureFlex System chassis. This network is isolated from the BNT 10Gb Ethernet switch. Figure 2 shows all the components used for this Subex test. PureFlex System rack Ethernet switch Intel node1 Fraud Management application server Intel node2 Fraud Management application and DB server Fibre Channel switch 4 Gb Fibre Channel IBM Storwize V TB disk External Ethernet network PureFlex System chassis management module Figure 2: Test environment physical layout 4

7 The Intel nodes in the PureFlex System rack will host the Subex Fraud Management solution. For this particular test, one Intel node runs just an application server and the second Intel node runs an application server and the database server as virtual machines on top of a Red Hat kernel-based virtual machine (KVM) hypervisor. PureFlex System internal management network The PureFlex System has a private internal network that provides a secure management network to manage the components within the PureFlex System chassis. This network includes an internal Ethernet switch internal to the CMM. All compute nodes and switches are configured on this network. For this configuration, the testing required only two Intel nodes. A fully configured PureFlex System can have as many as 14 compute nodes. BNT 10Gb switch Intel node 1 Intel node 2 QLogic 8Gb switch Management port IMM IMM Management port Internal CMM management network Internal Ethernet switch PureFlex System Chassis Management Module Figure 3: CMM internal management network The CMM has a network connect to the service or management port for each component in the chassis. For example it can talk to the integrated management module (IMM) and the POWER7 service processor. From that connection, operations such as operating system installations can be performed. Logical components and data networks The tested Subex Fraud Management solution was a two-tier environment consisting of an application server and a database server. The workload was initiated using a flat file generated externally that contained millions of CDR records that were processed by the application servers. The solution only requires a single 10Gb Ethernet network to handle the network traffic from the application server to the database server. 5

8 Database server RHEL 5.7 Virtual server 8 cores 8 GB memory /rangerdb Application server 2 RHEL 5.7 Virtual server 8 cores 16 GB memory /rangerbinary /rangerdata /rangerdump Application server 1 RHEL 5.7 RHEL 5.7 running KVM 16 cores 24 GB memory 16 cores 64 GB memory /rangerbinary /rangerdata /rangerdump Data network VLAN (10Gb) 8 Gb FC network PureFlex System FC Switch 4 Gb dual-port FC with 1 port enabled Storwize V7000 storage SAN storage RAID0 /rangerbinary = 100GB /rangerdata = 500 GB /rangerdb = 500 GB /rangerdump = 2 TB Figure 4: Test environment Logical layout KVM setup and configuration KVM is one of the virtualization environments supported in PureFlex System along with IBM PowerVM, VMware ESXi, and Microsoft Hyper-V. KVM is a full virtualization solution for Linux on x86 hardware containing virtualization extensions (Intel VT or AMD-V). Using KVM, one can run multiple virtual machines running unmodified Linux or Microsoft Windows images. Each virtual machine has private virtualized hardware: a network card, disk, graphics adapter, and so on. KVM is a loadable kernel module. In the KVM architecture, the virtual machine is implemented as a regular Linux process, scheduled by the standard Linux scheduler. In fact, each virtual machine appears as a regular Linux process. This allows KVM to benefit from all the features of the Linux kernel. Device emulation is handled by a 6

9 modified version of QEMU that provides an emulated basic I/O system (BIOS), Peripheral Component Interconnect (PCI) bus, Universal Serial Bus (USB), and a standard set of devices such as integrated development environment (IDE) and Small Computer System Interface (SCSI) disk controllers, network cards, and so on. KVM is a loadable kernel module that can be installed during the RHEL 5.7 installation. The virtual machine creation, configuration, virtual network setup, and hardware (HW) resource allocation is done by Virtual Machine Manager, a desktop application in RHEL. This application can also be used to monitor the performance and resource utilization of the virtual machines. Application server 1 and the database server were installed as virtual machines on KVM. Application Server 1 The application server is running RHEL 5.7 on a compute node with 16 cores and 64 GB of memory. The various components of the application architecture can be deployed over multiple machines and they interact with each other through regular TCP socket connections. The Application Server 1 was used to run the record dispatchers and record processors. Application Server 2 This application server is running as a virtual server on top of the Red Hat KVM hypervisor. The virtual server is running RHEL 5.7 and is assigned 8 cores and 16 GB memory. The various components of the application architecture can be deployed over multiple machines and they interact with each other through regular TCP socket connections. The Application Server 2 was used to run the counter manager and record processors. Database Server The database server is running as a virtual server on a Red Hat KVM hypervisor. The virtual server is running RHEL 5.7 with 8 cores and 8 GB of memory. The Database Server is running Oracle Enterprise Edition The configuration data for the application, such as rules and the reference data, such as the subscribers are stored in the database and the Database Server is used to serve the lookups into the reference data during the rule processing and when there are violations happening, the fraud alarms are generated and stored in the database. Storwize V7000 Unified SAN storage IBM Storwize V7000 Unified is a virtualized storage system designed to consolidate block and file workloads into a single storage system for simplicity of management, reduced cost, highly scalable capacity, performance, and high availability. IBM Storwize V7000 Unified storage also offers improved efficiency and flexibility through built-in solid-state drive (SSD) optimization, thin provisioning, and nondisruptive migration of data from the existing storage. The system can virtualize and reuse existing disk systems offering a greater potential of return on investment (ROI). Highlights of the Storwize V7000 Unified system include: 7

10 File support: Consolidates block and file storage in a single system for simplicity and greater efficiency IBM Active Cloud Engine : Enables highly efficient policy-based management of files to reduce costs through use of tiered storage Clustered systems: Ability for block systems to both scale up and scale out for performance and capacity. Automated storage tier: Advanced technology for automatically migrating data between storage tiers based on real-time usage analysis patterns New generation GUI: Easy-to-use data management designed with a graphical user interface and point-and-click system management capabilities Virtualized storage: Built in efficiency technologies virtualization, thin provisioning, IBM System Storage Easy Tier, and more IBM Storwize V7000 Unified SAN storage was used with PureFlex System for Subex Fraud Management solution testing. The storage used include eight SAS drives, each with 300 GB capacity and rpm speed; and two SSD drives each with 300 GB capacity. The storage is configured with RAID0. Easy Tier is configured as SSDs are part of the storage pool. Seven logical unit numbers (LUNs) are created from the array and mapped to Intel nodes to support the seven file systems needed for application servers and DB Server in the Fraud Management topology. The storage is not integrated inside the PureFlex System chassis. PureFlex System compute nodes are connected to the Storwize V7000 Unified storage by a 4Gb QLogic dual-port FC connection. However, only one port is enabled in the host bus adapter (HBA) on both the compute nodes and I/O traffic goes through that single port. Data virtual LAN (VLAN) The data VLAN is used for intercommunication between the application and database servers. This VLAN must support a significant load to hold the communication between the servers. In this configuration, the PureFlex System is using a BNT 10Gb scalable switch. Each compute node has a 10Gb Ethernet interface that is connected to the BNT switch through a LAN On Motherboard (LOM) connector to the back plane. PureFlex System advantage The PureFlex System can be configured with multiple BNT switches for redundancy and flexibility. The LOM provides the second Ethernet port connection to the second BNT switch. Configuring multiple VLANs with redundancy is an easy task with the PureFlex System. The multiple VLANs are easily configured. 8

11 Test process The objective of this test was to demonstrate the functionality of the Subex Fraud Management solution on the PureFlex System platform and make a note of the hints and tips on the deployment and record any optimization done to the hardware that enhances the Subex solution for the customer. The test process consists of running two test scenarios. The test scenarios are: Rule processing 100% participation for one aggregation Rule processing scalability for multiple aggregations Rule processing 100% participation for one aggregation The objective of this test was to check the processing throughput measured as records processed per second per core through the entire system, when the participation percentage for the rules is 100%. The participation percentage is defined as the percentage of records that get processed through the record processors compared to the number of records that get aggregated in the counter manager. When the participation percentage is 100, all the records which come in through the record processors participate in rules for which the counter manager needs to aggregate data and respond back with the aggregated data for every CDR. Rule processing scalability for multiple aggregations The objective of this test was to check the processing throughput measured as records processed per second per core through the entire system when the participation percentage for the rules is 100 and the number of aggregation types configured in the system is two. In this test, for each record getting processed by the record processor, there are two requests that go to two different counter managers and the accumulated value from two different counter managers are sent back as two different responses to the record processors. Test results During the test, adjustments were made to the environment to get the required results. The following sections cover specific settings for each of the solution elements. Intel node configuration / tuning The following section provides the kernel configurations and the Oracle configurations on the DB Server. Kernel configurations kernel.msgmnb = kernel.msgmax = kernel.shmmax = kernel.shmall =

12 kernel.sem = fs.file-max = net.core.rmem_default = net.core.wmem_default = net.core.rmem_max = net.core.wmem_max = fs.aio-max-nr = Oracle configurations orcl. db_cache_size= orcl. java_pool_size= orcl. large_pool_size= orcl. oracle_base='/home/oracle/app/oracle'#oracle_base set from environment orcl. pga_aggregate_target= orcl. sga_target= orcl. shared_io_pool_size=0 orcl. shared_pool_size= orcl. streams_pool_size= *.audit_file_dest='/home/oracle/app/oracle/admin/orcl/adump' *.audit_trail='db' *.compatible=' ' *.control_files='/home/oracle/app/oracle/oradata/orcl/control01.ctl','/home/oracle/app/oracle/fast_re covery_area/orcl/control02.ctl' *.db_32k_cache_size= *.db_block_size=8192 *.db_domain='' *.db_name='orcl' *.db_recovery_file_dest='/home/oracle/app/oracle/fast_recovery_area' *.db_recovery_file_dest_size= *.diagnostic_dest='/home/oracle/app/oracle' *.dispatchers='(protocol=tcp) (SERVICE=orclXDB)' 10

13 *.memory_target= *.open_cursors=300 *.processes=150 *.remote_login_passwordfile='exclusive' *.sga_max_size= *.undo_tablespace='undotbs1' Storwize V7000 Unified configuration / tuning The Storwize V7000 Unified system ran the code stream. For Fraud Management solution testing, the test team allocated eight 300 GB 10K SAS drives and two 300 GB SSDs. The drives are in different enclosures. Two managed disks (MDisks) were created with RAID0 in a single storage pool (single MDisk group). The first MDisk has eight SAS drives and second MDisk has the two SSDs. Easy Tier is configured as SSDs are available. Seven LUNs were created from the storage pool and mapped to the Intel nodes as show in Figure 4. The seven LUNs are used to create seven file systems needed by the two application servers and one DB Server shown in the Fraud Management topology in Figure 4 BNT switch configuration No BNT switch configuration was required. QLogic switch configuration No QLogic switch configuration was required. Zoning was not necessary. Rule processing 100% participation for one aggregation results For this scenario, the test team achieved a throughput speed of 600 records/sec/core Rule processing scalability for multiple aggregation results For this scenario, the test team achieved a throughput speed of 450 records/sec/core 11

14 Summary The PureFlex System is designed for flexibility with simplicity of an appliance with integrated expertise tuned to for a task. In a single package, heterogeneous hardware is integrated with networking and storage. It is highly reliable with no single point of failure. The testing done with the Subex Fraud Management system successfully demonstrates how this solution can run on the PureFlex System. Although this was not a performance test of the solution, it did demonstrate that the Fraud Management system ran well and can use the flexibility of this platform. 12

15 Resources These websites provide useful references to supplement the information contained in this paper: IBM Systems on PartnerWorld ibm.com/partnerworld/systems Virtual Loaner Program ibm.com/systems/vlp IBM Redbooks ibm.com/redbooks Subex subex.com Virtual Machine manager for KVM virt-manager.org/index.html KVM 13

16 Trademarks and special notices Copyright IBM Corporation References in this document to IBM products or services do not imply that IBM intends to make them available in every country. IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both. If these and other IBM trademarked terms are marked on their first occurrence in this information with a trademark symbol ( or ), these symbols indicate U.S. registered or common law trademarks owned by IBM at the time this information was published. Such trademarks may also be registered or common law trademarks in other countries. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at Java and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates. Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both. Intel, Intel Inside (logos), MMX, and Pentium are trademarks of Intel Corporation in the United States, other countries, or both. UNIX is a registered trademark of The Open Group in the United States and other countries. Linux is a trademark of Linus Torvalds in the United States, other countries, or both. Other company, product, or service names may be trademarks or service marks of others. Information is provided "AS IS" without warranty of any kind. All customer examples described are presented as illustrations of how those customers have used IBM products and the results they may have achieved. Actual environmental costs and performance characteristics may vary by customer. Information concerning non-ibm products was obtained from a supplier of these products, published announcement material, or other publicly available sources and does not constitute an endorsement of such products by IBM. Sources for non-ibm list prices and performance numbers are taken from publicly available information, including vendor announcements and vendor worldwide homepages. IBM has not tested these products and cannot confirm the accuracy of performance, capability, or any other claims related to non-ibm products. Questions on the capability of non-ibm products should be addressed to the supplier of those products. All statements regarding IBM future direction and intent are subject to change or withdrawal without notice, and represent goals and objectives only. Contact your local IBM office or IBM authorized reseller for the full text of the specific Statement of Direction. Some information addresses anticipated future capabilities. Such information is not intended as a definitive statement of a commitment to specific levels of performance, function or delivery schedules with respect to any future products. Such commitments are only made in IBM product announcements. The information is 14

17 presented here to communicate IBM's current investment and development activities as a good faith effort to help with our customers' future planning. Performance is based on measurements and projections using standard IBM benchmarks in a controlled environment. The actual throughput or performance that any user will experience will vary depending upon considerations such as the amount of multiprogramming in the user's job stream, the I/O configuration, the storage configuration, and the workload processed. Therefore, no assurance can be given that an individual user will achieve throughput or performance improvements equivalent to the ratios stated here. Photographs shown are of engineering prototypes. Changes may be incorporated in production models. Any references in this information to non-ibm websites are provided for convenience only and do not in any manner serve as an endorsement of those websites. The materials at those websites are not part of the materials for this IBM product and use of those websites is at your own risk. 15