Using Prognosis to monitor and actively block Toll Fraud.

[Michael_Gebhard]

I discussed some of this with Annie Leduc. I believe that it would be possible to utilize Prognosis (custom monitoring thresholds & node.js) to utilize Prognosis to monitor and actively block potential Toll Fraud calls. Annie stated that she believes their is a module for Prognosis that can write back to the CUCM's. With this in mind, my thoughts are Prognosis could potentially block calls for 2 scenarios (maybe more):
1.) Inbound call comes in to CUCM and then hair pins out (maybe as an example scenario to Unity where the dial by extension feature is used to then place a call outbound to an international number or one of the other known areas (I.E some of the Caribbean Islands)). In this scenario if the CUCM server is setup ahead of time with call blocking (https://supportforums.cisco.com/document/71966/blocking-calls-based-calling-party-id) where a template is used to only add the incoming Calling Party Number, write the number to the blocking Translation Pattern and thus block any further attempts.
2.) Internal call out to PSTN: This might be done, based on thresholds that look for 011 patterns between times where no calls are to be going out (I.E. 6 PM - 8 AM ). Prognosis could then write to the calling line and internal CSS to prevent further calls.
Those are just 2 scenarios, but the potential to use Prognosis to do this as well as become the first tool that would actually, not only monitor for potential Toll Fraud and act on it, are obtainable I believe.

[Annie_Leduc]

Hi Michael,
I believe this is a great idea and have communicated it to Valerie in Sydney (Telephony Product Manager) so we can have a further discussion on what would be the best approach for this feature. We have already put together some additional dashboards and report that provide visibility over some common Toll Fraud case for Cisco and Avaya. I would be happy to share them with you if you want to use them in your environment.

Next step for me will be to make the configuration more intuitive, then provide meaningful alerts (at this stage we only use visual alerting), then finally work in the automation pieces you described above.

Great idea and feedback thank you very much Michael

Annie

[Martin_Smith]

I think his IS a good enhancement idea, but we probably ought to be given due consideration/caution by Product Management. The reason for pointing this out is whilst it this may only be for toll fraud detection and prevention, if the (likely) preventative action is to (say) automatically modify a specific route pattern/CSS/other, then we are into the (larger) realms of configuration management. Something that SP platforms may (and do) ask for but it could be a large and serious undertaking, as well s quite a 'shift' for Prognosis. Not trying shoot anything down here, but there is a wider discussion implied.... Be interested to see what PM come back with.

[Michael_Gebhard]

I understand what you are saying on this. I am wondering since it has been a while since this was posted, were you able to find any further information from you side in reference to this?

[Martin_Smith]

Hi Michael,

I see that Annie has already passed this to our PM - don't know if it has received any response/reaction but can check. I stand by my original comment that modification of CUCM config puts us into a whole new arena (Systems control/config management), which should not be entered lightly...!

BTW - Regarding scenario - surely if that is a required then there would be a ToD CSS included in the config already...?!

ms.

[Anon]

Hi Michael,

I can confirm that your idea of toll fraud detection has been recorded in our system as a candidate for future product enhancement and it is a great idea!

I discussed with Annie internally. Prognosis will need to start working out country or even area codes from the called party string and count calls by country and potentially from a particular number/device like that from Unity. Then we will need to to help put that in a threshold to alert people of potential toll fraud.

That will be the first step.

After that, our consulting team might be able to help build the automation piece that block future call from happening. I mentioned consulting as it is altering configuration is a security concerns plus specific CUCM deployment/configuration will need to be considered as well.

Hope that's ok.

[Tonia K]

Do these scenarios currently work in Prognosis Version 11.2? is there any special programming needed or is it built in?

[Anon]

The called and calling party numbers are all in the CMCALL record that we have. The part that's not out of the box is way to work out the country code as it really depends on the number scheme, outside line plus international access code for the country you are in etc. I believe that Annie has been able to put things in place but it is very customised for the particular site.

[Venkatesh]

Hello All,

Can anyone help us with how can we set up a display and monitoring threshold on Toll Fraud events with detailed steps?

Thanks,

Venkatesh

[SCOTT_BALDWIN]

Hello @Venkatesh,

Currently, IR Collaborate does not currently have out of box solutions for isolating Toll Fraud.

There are some solutions available from Professional Services, but each solution needs to be customized for each environment and specific deliverables. The Account Manager should be contacted to engage with Professional Services for a the best solution to fit your needs.

Thank you,

Scott Baldwin