[OpenSIPS-Users] Opensips 2.5 and fraud module

Liviu Chircu liviu at opensips.org
Tue Apr 24 05:39:36 EDT 2018


Hi Denis,

It is difficult for me to assess your intervals, and triggering reasons. 
For example, your sheet starts at 07:08 AM, but the counter accumulation 
is reset way back, at 00:00.

Please provide some actual fraud event logs, with a log such as below, 
so we can blame the sequential calls for sure:

event_route [E_FRD_CRITICAL]
{
fetch_event_params("$var(param);$var(val);$var(thr);$var(user);$var(number);$var(ruleid)");
     xlog("E_FRD_CRITICAL: 
$var(param);$var(val);$var(thr);$var(user);$var(number);$var(ruleid)\n");
}

Best regards,

Liviu Chircu
OpenSIPS Developer
http://www.opensips-solutions.com

On 24.04.2018 12:06, Denis via Users wrote:
> Hello Liviu!
> "Yes, the "sequential calls" holds the size of the last batch of calls
> sent to the same number. For example, if a user were to dial 44 and 45
> prefixes in a round-robin manner, his "sequential calls" value would
> never exceed 1."
> Here you can find acc from one of the client (from the beginning of 
> the 24.04)
> https://yadi.sk/i/Zkj70CCM3UiEyw
> and fraud module params looks like
>                    prefix: 810
>                start_hour: 00:00
>                  end_hour: 23:59
>             daysoftheweek: Mon-Sun
>               cpm_warning: 10
>              cpm_critical: 11
>     call_duration_warning: 1499
>    call_duration_critical: 1500
>       total_calls_warning: 99
>      total_calls_critical: 100
>  concurrent_calls_warning: 25
> concurrent_calls_critical: 30
>  sequential_calls_warning: 14
> sequential_calls_critical: 15
> Something wronge))))
> As you can see the client dial different numbers but module detects 
> fraud anyway.
> -- 
> С уважением, Денис.
> Best regards, Denis
> 19.04.2018, 18:14, "Liviu Chircu" <liviu at opensips.org>:
>>
>> Hi Denis!
>>
>> Good catch! For the first time, I documented a parameter, but forgot 
>> to export it for the script writer as well! :)
>>
>> It is now fixed. Thank you!
>>
>> Cheers,
>>
>> Liviu Chircu
>> OpenSIPS Developer
>> http://www.opensips-solutions.com <http://www.opensips-solutions.com/>
>> On 19.04.2018 17:28, Denis via Users wrote:
>>> Hello, Liviu!
>>> I had installed latest Opensips 2.2 (Opensips 2.2.6)
>>> In a log file, during start of Opensips, i can see
>>> ERROR:core:set_mod_param_regex: parameter <use_local_time> not found 
>>> in module <fraud_detection>
>>> Where is mistake?
>>> Thank you.
>>> -- 
>>> С уважением, Денис.
>>> Best regards, Denis
>>> 13.04.2018, 09:49, "Denis via Users" <users at lists.opensips.org> 
>>> <mailto:users at lists.opensips.org>:
>>>> Ok, thank you
>>>> -- 
>>>> С уважением, Денис.
>>>> Best regards, Denis
>>>> 12.04.2018, 14:23, "Liviu Chircu" <liviu at opensips.org 
>>>> <mailto:liviu at opensips.org>>:
>>>>>
>>>>> Use $Ts [1] to get the current UNIX timestamp in seconds.
>>>>>
>>>>> [1]: http://www.opensips.org/Documentation/Script-CoreVar-2-4#toc91
>>>>>
>>>>> Liviu Chircu
>>>>> OpenSIPS Developer
>>>>> http://www.opensips-solutions.com <http://www.opensips-solutions.com/>
>>>>> On 12.04.2018 14:08, Denis via Users wrote:
>>>>>> Liviu, is there any way to find out current time from Opensips 
>>>>>> during call processing (some functions, variables etc which i can 
>>>>>> use in opensips.cfg)?
>>>>>> Thank you
>>>>>> -- 
>>>>>> С уважением, Денис.
>>>>>> Best regards, Denis
>>>>>> 12.04.2018, 13:50, "Liviu Chircu" <liviu at opensips.org> 
>>>>>> <mailto:liviu at opensips.org>:
>>>>>>>
>>>>>>> Hi Denis,
>>>>>>>
>>>>>>> The fraud detection module has no such mechanism, currently. We 
>>>>>>> could invent some variables such as $frd_last_warn, 
>>>>>>> $frd_last_crit, $frd_first_warn, $frd_first_crit. They would 
>>>>>>> output a UNIX timestamp. If there were no warnings during the 
>>>>>>> current interval, the timestamp value would be 0. Can't think of 
>>>>>>> anything better now - you can polish this idea and open up a 
>>>>>>> pull request if you want.
>>>>>>>
>>>>>>> How many users do you have? The "cachedb_local" offers a fast 
>>>>>>> and configurable hash implementation. Why wouldn't it be a good 
>>>>>>> solution in order to store/fetch the above-mentioned timestamps 
>>>>>>> for each of your users?
>>>>>>>
>>>>>>> Best regards,
>>>>>>>
>>>>>>> Liviu Chircu
>>>>>>> OpenSIPS Developer
>>>>>>> http://www.opensips-solutions.com 
>>>>>>> <http://www.opensips-solutions.com/>
>>>>>>> On 10.04.2018 13:11, Denis via Users wrote:
>>>>>>>> Hello, Liviu!
>>>>>>>> "So you want to check the time of the last fraud detection 
>>>>>>>> attempt for a user?"
>>>>>>>> Yes, but not for store this time to anywhere.
>>>>>>>> I want to detect the time of the first fraud call, and if this 
>>>>>>>> time, for example, between 19:00 and 09:00, make some actions.
>>>>>>>> Can i do it with Opensips?
>>>>>>>> Thank you.
>>>>>>>> -- 
>>>>>>>> С уважением, Денис.
>>>>>>>> Best regards, Denis
>>>>>>>> 10.04.2018, 12:28, "Liviu Chircu" <liviu at opensips.org> 
>>>>>>>> <mailto:liviu at opensips.org>:
>>>>>>>>>
>>>>>>>>> Hi Denis,
>>>>>>>>>
>>>>>>>>> Yes, the "sequential calls" holds the size of the last batch 
>>>>>>>>> of calls
>>>>>>>>> sent to the same number. For example, if a user were to dial 
>>>>>>>>> 44 and 45
>>>>>>>>> prefixes in a round-robin manner, his "sequential calls" value 
>>>>>>>>> would
>>>>>>>>> never exceed 1.
>>>>>>>>>
>>>>>>>>> So you want to check the time of the last fraud detection 
>>>>>>>>> attempt for a
>>>>>>>>> user? You can use "cachedb_local", for example, and hold the 
>>>>>>>>> last fraud
>>>>>>>>> detection timestamp for each user. Also, note that 
>>>>>>>>> check_fraud() [1] has
>>>>>>>>> some useful return codes (-1 and -2), in case you don't want 
>>>>>>>>> to use the
>>>>>>>>> E_FRD_ events.
>>>>>>>>>
>>>>>>>>> Cheers,
>>>>>>>>>
>>>>>>>>> [1]:
>>>>>>>>> http://www.opensips.org/html/docs/modules/2.4.x/fraud_detection.html#func_check_fraud
>>>>>>>>>
>>>>>>>>> Liviu Chircu
>>>>>>>>> OpenSIPS Developer
>>>>>>>>> http://www.opensips-solutions.com 
>>>>>>>>> <http://www.opensips-solutions.com/>
>>>>>>>>>
>>>>>>>>> On 09.04.2018 09:12, Denis via Users wrote:
>>>>>>>>>
>>>>>>>>>      Hello, Liviu!
>>>>>>>>>      Thank you very much!
>>>>>>>>>      I will try your fix.
>>>>>>>>>      And, What does "Sequential calls" mean? These are calls
>>>>>>>>>     to one number?
>>>>>>>>>      So, if we have situation dealing with reset counters, i
>>>>>>>>>     want to make
>>>>>>>>>      one thing.
>>>>>>>>>      I want to check the time when fraud has been detected and
>>>>>>>>>     if this
>>>>>>>>>      time, say, after 19:00 make some actions. How can i check
>>>>>>>>>     time of the
>>>>>>>>>      call processing?
>>>>>>>>>      Thank you.
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>
>>>>>>>>> _______________________________________________
>>>>>>>>> Users mailing list
>>>>>>>>> Users at lists.opensips.org <mailto:Users at lists.opensips.org>
>>>>>>>>> http://lists.opensips.org/cgi-bin/mailman/listinfo/users
>>>>>>>>>
>>>>>>>> _______________________________________________
>>>>>>>> Users mailing list
>>>>>>>> Users at lists.opensips.org <mailto:Users at lists.opensips.org>
>>>>>>>> http://lists.opensips.org/cgi-bin/mailman/listinfo/users
>>>>>>> ,
>>>>>>>
>>>>>>> _______________________________________________
>>>>>>> Users mailing list
>>>>>>> Users at lists.opensips.org <mailto:Users at lists.opensips.org>
>>>>>>> http://lists.opensips.org/cgi-bin/mailman/listinfo/users
>>>>>>>
>>>>>> _______________________________________________
>>>>>> Users mailing list
>>>>>> Users at lists.opensips.org <mailto:Users at lists.opensips.org>
>>>>>> http://lists.opensips.org/cgi-bin/mailman/listinfo/users
>>>>> ,
>>>>>
>>>>> _______________________________________________
>>>>> Users mailing list
>>>>> Users at lists.opensips.org <mailto:Users at lists.opensips.org>
>>>>> http://lists.opensips.org/cgi-bin/mailman/listinfo/users
>>>>>
>>>> ,
>>>>
>>>> _______________________________________________
>>>> Users mailing list
>>>> Users at lists.opensips.org <mailto:Users at lists.opensips.org>
>>>> http://lists.opensips.org/cgi-bin/mailman/listinfo/users
>>>>
>>> _______________________________________________
>>> Users mailing list
>>> Users at lists.opensips.org <mailto:Users at lists.opensips.org>
>>> http://lists.opensips.org/cgi-bin/mailman/listinfo/users
>> ,
>>
>> _______________________________________________
>> Users mailing list
>> Users at lists.opensips.org <mailto:Users at lists.opensips.org>
>> http://lists.opensips.org/cgi-bin/mailman/listinfo/users
>>
>
>
> _______________________________________________
> Users mailing list
> Users at lists.opensips.org
> http://lists.opensips.org/cgi-bin/mailman/listinfo/users

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.opensips.org/pipermail/users/attachments/20180424/14932457/attachment-0001.html>


More information about the Users mailing list