Trigger Calibration Reports

Introduction

The Trigger Calibration Reports can be used to modify the fraud trigger thresholds based on historical call data. These reports are most useful after ClearIP’s fraud control has analyzed calls for at least a few weeks.

Trigger Calibration Reports

The Trigger Calibration Reports enable you to choose your fraud trigger threshold values based on historical call data up to the past 12 weeks.

Trigger Type

You can select the type of fraud trigger you are interested in configuring under Trigger Type and then click Update Report.

Depending on the Trigger Type selected, there will also be optional filters for viewing data for a specific Calling Number, Called Number, Service Provider, Group, and/or User. These filters can be left blank to not apply a filter.

In the example above, we selected Fast Traffic Pumping by Calling Number as the Trigger Type so we can compare the configured fraud trigger threshold values with the actual calling patterns based on the past 8 weeks of data.

To generate the example report, ClearIP divided the last 8 weeks into discrete 5 minute intervals. In each 5 minute interval, ClearIP looks at each calling number and called country pair and analyzes the fraud scores. The trigger calibration report shows the historical fraud score trends for each calling number and called country pair for which calls have been made in the last 8 weeks. By default the records are listed by descending maximum fraud score.

Each Fraud Trigger type has a defined analysis period length.

Data Displayed

ClearIP will only display the data of all calls for which fraud analysis is enabled. Data for calls that are not monitored for fraud will not be displayed in the report. For example, if fraud analysis is disabled on domestic calls, then data for domestic calls will not be displayed in the reports.

These reports will combine data for all calls to include data for both legitimate calls and calls suspected of being fraudulent. In the reports, you will see calls where the maximum fraud scores exceed the fraud score threshold value as well as calls where the fraud scores fall below the fraud score threshold values. This allows you to compare the data for legitimate traffic side by side with the data for potentially fraudulent traffic.

Weeks to Analyze

The Weeks to Analyze field indicate how many past weeks of data ClearIP should process to build the report. This number must be from 1 to 12.

Period Count

For the Fast Traffic Pumping Trigger Type, the Period Count column shows the number of separate 5 minute windows where the calling number has made at least 1 call to the specified country during the selected Weeks to Analyze period. A high Period Count indicates that the calling number regularly makes calls to the called country.

As an example, we have a SIP Chart that visualizes the call activity from a specific calling number over 1 hour. The x-axis displays the time when calls were placed and is divided into 5 minute increments. The y-axis displays the number of call attempts that were made within each 5 minute increment. A value of 2 at 11:30 am indicates that 2 call attempts were placed between 11:30 - 11:35 am.

In the data displayed in this SIP Chart, the trigger calibration report would assign a Period Count of 7 because there were 7 different 5 minute increments where there was at least 1 call attempt. Any number of calls could have been placed during those periods, but observing the calling patterns over time, the call attempts did not take place outside of a combined duration of 35 minutes out of a total 60 minutes since there were 7 separate 5 minute periods.

SIP Count

The SIP Count column shows the total number of calls made from the calling number to the call destination throughout the entire selected Weeks to Analyze period.

In the example SIP Chart, the SIP Count over the entire hour would be 14. This is obtained by adding up the call attempts within each Period where there was at least 1 call attempt made.

The Period Count and SIP Count data combined can help you determine how the calls were spread over time. For example, a Period Count of 1 with SIP Count of 10 indicates that 10 calls were placed within the exact same period of 5 minutes in the case of the Fast traffic pumping trigger. However, a Period Count of 10 with SIP Count of 10 indicates that 1 call was placed in a 5 minute period for 10 different 5-minute periods.

P-XX Fraud Score

The P-99 Fraud Score column shows the 99th percentile fraud score value. This is the cumulative fraud score value for a 5 minute window that is greater than 99% of the fraud scores of all other 5 minute windows. Likewise the P-95 Fraud Score column refers to the 95th percentile fraud score value. The differences between the column values gives you an indication of how varied the fraud scores are. These columns can provide useful data if the Period Count is not low. If the Period Count is very low, then these columns may be ignored.

Compare fraud scores to current thresholds

You will need to compare the fraud scores in the Trigger Calibration Reports with the current fraud score threshold.

In this example Fast Traffic Pumping by Calling Number trigger, the current default fraud score is 1 for a wildcard calling number and wildcard country.

Comparing this to the Trigger Calibration Report, the first two rows (highlighted) referring to calls from 19856014153 to South Africa and calls from 12254741700 to Jamaica both have fraud score values higher than the default threshold of 1. This means both of these sets of calls activated trigger events within ClearIP. The calls described in the third row and below in the report have lower fraud scores than 1, so these calls would not have activated a trigger event.

It is critical to scrutinize which calls are legitimate and which calls are fraudulent. If there are any fraudulent calls included in the report, then the fraud scores for fraudulent calls tend to be drastically higher than the fraud scores for legitimate calls. This allows you to determine a clear threshold value that separates fraudulent and legitimate calls. If there are only non-fraudulent calls shown in the report, then the fraud trigger thresholds should be modified to be high enough to prevent false positives, but low enough to quickly catch fraud.

Modify fraud score thresholds

Looking at the Trigger Calibration Reports, we see that calling numbers tend to call a few countries with a fraud score of between 1 and 1.5, but they tend to call all other countries with a fraud score of 1 or less. We can decide that if any calling number calls to South Africa, Jamaica, and Switzerland enough times within 5 minutes to accumulate a fraud score greater than 1.5, we suspect the calls to be fraudulent. We can also decide that if any user calls any other country to accumulate a fraud score greater than 1 within 5 minutes, we suspect the calls to be fraudulent.

To translate these decisions into fraud triggers, we can create the following triggers:

1. A wildcard trigger that covers all calling numbers and all called countries with a default threshold value of 1.

2. Three exception triggers that covers all calling numbers and South Africa, Jamaica, and Switzerland as the called countries with a default threshold value of 1.5.

These threshold values can be adjusted later if necessary.

Investigate call traffic

To see more details of call activity displayed in the Trigger Calibration Report, you must use the SIP Messages, SIP Reports, or SIP Charts pages and manually set specific filters.

For example, if you would like to see the calls from calling number 12254741700 to Jamaica, described in the second row of the above Trigger Calibration Report, you can go to the SIP Messages page and then enter 12254741700 into the Translated Calling Number filter and enter Jamaica into the Called Country filter.

These same filters can be applied on the SIP Reports and SIP Charts as well.