Difference between revisions of "Dynamic Blacklist Functionality"

From Kolmisoft Wiki
Jump to navigationJump to search
 
(20 intermediate revisions by 6 users not shown)
Line 1: Line 1:
=Dynamic Blacklisting=
=Dynamic Blacklisting=


Dynamic Blacklist functionality is based on a smart logic which puts a 'score' on the call by its Source Number, Destination Number and SIP signaling IP and allows routing calls with high score over different route.  
'''NOTE:''' This functionality can be used with a [http://wiki.kolmisoft.com/index.php/Monitorings_Addon Monitorings Addon] enabled only.


This functionality gives you ability to define Blacklist LCR. MOR reroutes all the calls, that have a score more than a defined threshold, to this Blacklist LCR. Dynamic Blacklisting is useful when system owner wants to route 'suspect' calls through different route than 'normal' calls.
Dynamic Blacklist functionality is based on a smart logic that puts a 'score' on the call by its Source Number, Destination Number, and SIP signaling IP and allows routing calls with a high score over a different route.
 
This functionality gives you the ability to define Blacklist LCR. MOR reroutes all the calls, that have a score more than a defined threshold, to this Blacklist LCR. Dynamic Blacklisting is useful when the system owner wants to route 'suspect' calls through a different route than 'normal' calls.


Example: calls from such countries as Nigeria, Sudan, etc. based on their IP/CallerID can be marked as 'suspects' and routed to some IVR or to the dead-end.
Example: calls from such countries as Nigeria, Sudan, etc. based on their IP/CallerID can be marked as 'suspects' and routed to some IVR or to the dead-end.


If you are looking for simple Blacklisting implementation, refer to [[Static_Blacklist_and_Whitelist_functionality#Blacklists_.2F_Whitelists|Static Blacklist/Whitelist]]
<br><br>
==Dynamic Blacklisting settings==
==Dynamic Blacklisting settings==


Line 13: Line 18:
[[File:Dynamic bl menu.png]]
[[File:Dynamic bl menu.png]]


<br><br>
==How does it work==
==How does it work==


When calls comes to MOR, system tries to find score for Source Number, Destination Number and SIP signaling IP. These scores are summed into single value:
When calls come to MOR, the system tries to find the score for the Source Number, Destination Number, and SIP signaling IP. These scores are summed into a single value:


  TOTAL SCORE = DST SCORE + SRC SCORE + IP SCORE
  TOTAL SCORE = DST SCORE + SRC SCORE + IP SCORE


Then total score is compared against defined Blacklisting Threshold value. If total score ir equal ir higher than Blacklisting Threshold value, system changes LCR to defined Backlisting LCR.
The total score is compared against the defined Blacklisting Threshold value. If the total score is equal to or higher than the Blacklisting Threshold value, the system changes LCR to the defined Backlisting LCR.


It is important to understand that Dynamic Blacklisting checks all three scores (DST, SRC and IP) before deciding whether call should be blacklisted (changed LCR) or not.
It is important to understand that Dynamic Blacklisting checks all three scores (DST, SRC, and IP) before deciding whether calls should be blacklisted (changed LCR) or not.


<br><br>
==Threshold==
==Threshold==


Line 29: Line 36:
[[File:Dynamic bl settings thresholds.png]]
[[File:Dynamic bl settings thresholds.png]]


You can use up to 3 different Threshold values but for simplicity we will use only first one.
You can use up to 3 different Threshold values but for simplicity, we will use only the first one.


Calculated Blacklisting total score will be compared to this value. If calculated Blacklisting total score is equal or higher than 100, User’s current LCR will be changed to Blacklisting LCR. If total score is lower than 100, User’s LCR will not be changed.
The calculated Blacklisting total score will be compared to this value. If the calculated Blacklisting total score is equal to or higher than 100, the User’s current LCR will be changed to Blacklisting LCR. If the total score is lower than 100, the User’s LCR will not be changed.


<br><br>
==Blacklisting LCR==
==Blacklisting LCR==


When calculated Blacklisting score is higher than Blacklisting Threshold, User’s LCR is changed to Blacklisting LCR.
When the calculated Blacklisting score is higher than Blacklisting Threshold, User’s LCR is changed to Blacklisting LCR.


This LCR may contain specific Providers or can be completely empty. In case of empty LCR, call will be hangup with code:
This LCR may contain specific Providers or can be completely empty. In case of an empty LCR, the call will be hangup with the code:


  204 No suitable providers found
  204 No suitable providers found


<br><br>
==How score is calculated==
==How score is calculated==


When call comes to MOR, Blacklisting score is calculated by finding score for SRC, DST and IP in Blacklisting database.
When a call comes to MOR, the Blacklisting score is calculated by finding the score for SRC, DST, and IP in the Blacklisting database.


For example, let’s explain how score is calculated for Destination Number (DST). Source and IP score is calculated in the same way.
For example, let’s explain how the score is calculated for the Destination Number (DST). Source and IP score is calculated in the same way.


When new number is dialed and it is not yet in Blacklisting database, MOR tries to assign score to number by checking Blacklisting prefix database, which can de defined in '''ADDONS''' -> '''Monitoring''' -> '''Dynamic Blacklisting''' -> '''Destinations (DST)''' -> '''Prefix scores''':
When a new number is dialed and it is not yet in the Blacklisting database, MOR tries to assign a score to the number by checking the Blacklisting prefix database, which can be defined in '''ADDONS''' -> '''Monitoring''' -> '''Dynamic Blacklisting''' -> '''Destinations (DST)''' -> '''Prefix scores''':


[[File:Dynamic bl prefix scores.png]]
[[File:Dynamic bl prefix scores.png]]


For example, if someone dials 93xxxxxx, MOR assigns score 70 to this number and puts this number along with score to Blacklisting database. Next time this number is dialed, MOR will know score by looking in Blacklisting database.
For example, if someone dials 93xxxxxx, MOR assigns a score of 70 to this number and puts this number along with the score into the Blacklisting database. Next time this number is dialed, MOR will know the score by looking in the Blacklisting database.


What happens when score is not set for prefix? For example, if someone dials 370xxxx but Prefix scores database does not have prefix for this number, then default score will be used. You can set default score in '''ADDONS''' -> '''Monitoring''' -> '''Dynamic Blacklisting''' -> '''Settings''':
What happens when the score is not set for the prefix? For example, if someone dials 370xxxx but the Prefix scores database does not have a prefix for this number, then the default score will be used. You can set default score in '''ADDONS''' -> '''Monitoring''' -> '''Dynamic Blacklisting''' -> '''Settings''':


[[File:Dynamic bl settings default scores.png]]
[[File:Dynamic bl settings default scores.png]]


'''Note:''' numbers with default score will not be saved to Blacklisting database. System will assume that numbers that are not present in Blacklisting database have default score and use that score when calculating Blacklisting score.
'''Note:''' numbers with default scores will not be saved to the Blacklisting database. The system will assume that numbers that are not present in the Blacklisting database have a default score and use that score when calculating the Blacklisting score.


Same principle is used for SRC and IP score - '''when call comes MOR, Dynamic Blacklisting checks if DST/SRC/IP is in Backlisting database, if not then checks if prefix exists in Blacklisting prefixes database, if not then uses default Blacklisting score.'''
The same principle is used for SRC and IP score - ''' when call comes MOR, Dynamic Blacklisting checks if DST/SRC/IP is in Backlisting database, if not then check if prefix exists in Blacklisting prefixes database, if not then uses default Blacklisting score.'''


These 3 scores are summed (DST score + SRC score + IP Score) and compared against Blacklisting Threshold value. If total score is equal or higher, then User’s LCR will be changed to Blacklisting LCR.
These 3 scores are summed (DST score + SRC score + IP Score) and compared against the Blacklisting Threshold value. If the total score is equal or higher, then User’s LCR will be changed to Blacklisting LCR.


If you use only DST blacklisting, you may leave Default SRC and Default IP scores 0. This way it will be easier to calculate Blacklisting score (DST score + 0 + 0).
If you use only DST blacklisting, you may leave Default SRC and Default IP scores 0. This way it will be easier to calculate the Blacklisting score (DST score + 0 + 0).


<br><br>
==Blacklisting database==
==Blacklisting database==


Line 71: Line 81:
[[File:Dynamic bl scores.png]]
[[File:Dynamic bl scores.png]]


In this page you can find, add, update or delete numbers.
On this page, you can find, add, update or delete numbers.


If you want to import numbers to Blacklisting database, use following format in CSV file:
If you want to import numbers to the Blacklisting database, use the following format in a CSV file:


  number1;score
  number1;score
Line 79: Line 89:
  number3;score
  number3;score


<br><br>
==SIP signaling IP==
==SIP signaling IP==


Due to technical limitations, Dynamic Blacklisting will use SIP signaling IP which may be different from RTP (media) of Originator.
Due to technical limitations, Dynamic Blacklisting will use SIP signaling IP which may be different from the RTP (media) of the Originator.


==Dynamic Blacklisting for specific Users==
==Dynamic Blacklisting for specific Users==


Dynamic Blacklisting blacklisting can be enabled globally to all Users or for specific Users only.
Dynamic Blacklisting blacklisting can be enabled globally for all Users or for specific Users only.


If you want to enable Dynamic Blacklisting globally, go to '''ADDONS''' -> '''Monitoring''' -> '''Dynamic Blacklisting''' -> '''Settings''' and check '''Blacklist Feature enabled''' checkbox.
If you want to enable Dynamic Blacklisting globally, go to '''ADDONS''' -> '''Monitoring''' -> '''Dynamic Blacklisting''' -> '''Settings''' and check '''Blacklist Feature enabled''' checkbox.


If you want to enable Dynamic Blacklisting for specific User, go to User’s edit page and change settings under '''Blacklisting / Whitelisting''' section:
If you want to enable Dynamic Blacklisting for a specific User, go to the User’s edit page and change settings under '''Blacklisting / Whitelisting''' section:


[[File:Dynamic bl user settings.png]]
[[File:Dynamic bl user settings.png]]


<br><br>
=Dynamic Blacklisting script (advanced)=
=Dynamic Blacklisting script (advanced)=


Dynamic Blacklisting script allows to add numbers to Dynamic Blacklisting database based on Blacklisting rules.
Dynamic Blacklisting script allows to add numbers to the Dynamic Blacklisting database based on Blacklisting rules.


Some examples of Blacklisting rules:
Some examples of Blacklisting rules:


* Set score 100 to DST number if there are 2 or more calls during 5 minutes to the same number
* Set score 100 to DST number if there are 2 or more calls during 5 minutes to the same number
* Set score 100 to DST number if there are 5 or more calls with duration lower than 30 seconds to the same number
* Set score 100 to DST number if there are 5 or more calls with a duration lower than 30 seconds to the same number
* Set score 100 to DST number if there are 3 or more calls to the same number and number length is lower than 6 digits
* Set score 100 to DST number if there are 3 or more calls to the same number and the number length is lower than 6 digits
 
The minimal check time is 1 minute (you cannot create a rule 'set score X if there are 10 or more calls during 30 seconds). Maximum time 24 hours.
The script is set to run every minute, so if the script is set to block new calls as in 1st example, the script will check if calls should be blocked every minute.
 


These rules are defined in:
These rules are defined in:
Line 107: Line 123:
  /usr/local/mor/blacklist.conf
  /usr/local/mor/blacklist.conf


Configuration file contains all rules with examples:
The configuration file contains all rules with examples:


  ; ABOUT THIS FILE
  ; Rules have the following structure:
;
; type,prefix,count,period,score
;
; type  - type of rule (src/dst/ip/dstsrc/dstduration/srcduration/srclength/dstlength/srcbldst)
; prefix - prefix or keyword (only for src) used to match the target (src/dst/ip)
; count  - how many TIMES this target can be dialed/make calls during specified period of time (in minutes), before this rule is applied
; period - defines the PERIOD of time (in minutes) which is used to check calls (takes all calls made within last X minutes)
; score  - score that will be ADDED to previous score of the target
  ;
  ;
  ; This configuration file describes blacklisting rules
  ; Note1: to match all the targets of the same rule type, use * symbol instead of prefix
   
; Note2: in case of dstduration and srcduration, count is time in seconds of a call
   
; Note3: in case of dstlength and srclength, count is the length of the number
  ; Rule types explained below
; Note4: in case of dstsrc rule, you can you EMPTY keyword instead prefix. This allows to block dst if numbers without src are calling to this dst
  ; Note5: in case of srcbldst rule, count is blacklisting score of dst number
  ;
  ; Rule types explained
   
   
   
   
Line 122: Line 149:
  ; Examples:
  ; Examples:
  ;
  ;
  ; src,370123456,1,5,10
  ; src,mor,1,5,10
  ; src,*,5,60,100
  ; src,1001,1,10,20
  ;
  ;
  ; Examples explained:
  ; Examples explained:
  ;
  ;
  ; 1. If src '370123456' makes 1 or more calls during 5 minutes period, its blacklisting score will be set to 10
  ; 1. If src 'accountant_mor_25' makes 1 or more calls during 5 minutes period, its blacklisting score will be updated by 10
  ; 2. If any src makes 5 or more calls during 1 hour period, its blacklisting score will be set to 20
  ; 2. If src '1001' makes 1 or more calls during 10 minutes period, its blacklisting score will be updated by 20
   
   
   
   
Line 142: Line 169:
  ; Examples explained:
  ; Examples explained:
  ;
  ;
  ; 1. If dst '37062255555' is dialed 5 or more times during 60 minutes period, its blacklisting score will be set to 50
  ; 1. If dst '37062255555' is dialed 5 or more times during 60 minutes period, its blacklisting score will be increased by 50
  ; 2. If dst '37062155555' is dialed 5 or more times during 60 minutes period, its blacklisting score will be set to 30
  ; 2. If dst '37062155555' is dialed 5 or more times during 60 minutes period, its blacklisting score will be increased by 30
  ; 3. If any dst is dialed 10 or more times during 10 minutes period, its blacklisting score will be set to 10
  ; 3. If any dst is dialed 10 or more times during 10 minutes period, its blacklisting score will be increased by 10
; Type: IP
; Description: put a score on ip, based on ip address and number of calls FROM that ip address in a defined time period
;
; Examples:
;
; ip,78.35,1,15,1
;
; Examples explained:
;
; 1. If ip '78.35.45.21' makes 1 or more calls during 15 minutes period, its blacklisting score will be increased by 1
; Type: dstsrc
; Description: put a score on dst, based on src number and number of calls FROM that src in a defined time period
;
; Examples:
;
; dstsrc,anonymous,1,5,50
; dstsrc,EMPTY,1,5,50
;
; 1. If src 'anonymous' makes 1 or more calls during 5 minutes period, then blacklisting score will be increased by 50 TO THE NUMBER USER HAS DIALED (dst number)
; 2. If call with no src makes 1 or more calls during 5 minutes period, then blacklisting score will be increased by 50 TO THE NUMBER USER HAS DIALED (dst number)
   
   
   
   
  ; Type: dstduration
  ; Type: dstduration
  ; Description: put a score on dst, based on call duration to this dst number in a defined time period
  ; Description: put a score on dst, based on lowest call duration to this dst number in a defined time period
  ;
  ;
  ; Examples:
  ; Examples:
  ;
  ;
  ; dstduration,370,30,5,3,45
  ; dstduration,370,30,5,45
  ;
  ;  
  ; 1. If within last 5 minutes there are at least 3 calls to dst number 370xxxxxx that have duration shorter than 30 seconds, then dst number's score will be set to 45
  ; 1. If within last 5 minutes there are calls to dst number 370xxxxxx that have duration shorter than 30 seconds, then dst number's score will be increased by 45
   
   
   
   
Line 162: Line 213:
  ; Examples:
  ; Examples:
  ;
  ;
  ; srcduration,*,60,1,2,45
  ; srcduration,*,60,1,45
  ;
  ;  
  ; 1. If within last minute there are at least 2 calls calls from any src number that have duration shorter than 60 seconds, then src number's score will be set to 45
  ; 1. If within last minute there are calls from any src number that have duration shorter than 60 seconds, then src number's score will be increased by 45
   
   
   
   
Line 172: Line 223:
  ; Examples:
  ; Examples:
  ;
  ;
  ; dstlength,*,6,1,5,10
  ; dstlength,*,6,1,10
  ;
  ;  
  ; 1. If within last minute there are at least 5 calls to any dst number that has length shorter or equal to 6 charaters, then dst number's score will be set to 10
  ; 1. If within last minute there are calls to any dst number that has length shorter or equal to 6 charaters, then dst number's score will be increased by 10
  ;
  ;
  ; In this case:
  ; In this case:
  ;
  ;
  ; Number 370621 will be blacklisted
  ; Number 370621 will be blacklisted
  ; Number 3706215 will not be blacklisted  
  ; Number 3706215 will not be blacklisted
   
   
   
   
Line 187: Line 238:
  ; Examples:
  ; Examples:
  ;
  ;
  ; srclength,*,2,5,3,30
  ; srclength,*,2,5,30
;
; 1. If within last 5 minutes there are calls from any src number that has length shorter or equal to 2 charaters, then src number's score will be increased by 30
; Type: srcbldst
; Description: put a score on src if user calls to dst which has equal or higher score than defined
;
; Examples:
;
; srcbldst,*,60,2,30
  ;
  ;
  ; 1. If within last 5 minutes there are at least 3 calls from any src number that has length shorter or equal to 2 charaters, then src number's score will be set to 30
  ; 1. If within last 2 minutes any src number made a call to dst which has blacklisting score 60 or higher, then src number's score will be increased by 30  
   
   
   
   
  ; To comment out a rule, use ; character before rule
  ; To comment out a rule, use ; character before rule
;
; Note: only one rule will be applied to the same src/dst/ip so rules should be ordered by prefix length (from longest to shortest (or *))
   
   
  ; Rules start here, please modify them
  ; Rules start here
 
Add your rules at the end of blacklist.conf file.
Add your rules at the end of blacklist.conf file.


Note that examples in your configuration file might be outdated, thefore use examples from this page.
Note that examples in your configuration file might be outdated, therefore use examples from this page.


This script can be enabled or disabled at any time. Check '''Enable Dynamic Blacklisting script''' checkbox in '''ADDONS''' -> '''Monitoring''' -> '''Dynamic Blacklisting''' -> '''Settings''':
This script can be enabled or disabled at any time. Check '''Enable Dynamic Blacklisting script''' checkbox in '''ADDONS''' -> '''Monitoring''' -> '''Dynamic Blacklisting''' -> '''Settings''':
Line 205: Line 266:
[[File:Dynamic bl settings enable script.png]]
[[File:Dynamic bl settings enable script.png]]


Note that script does not work in realtime and blacklisted number are added to Blacklisting database within a minute or two.
Note that the script does not work in real-time and blacklisted numbers are added to the Blacklisting database within a minute or two.


Also, only single rule is applied to the same number at a time so order you rules by priority.
Also, only a single rule is applied to the same number at a time so order your rules by priority.


<br><br>
=Troubleshooting=
=Troubleshooting=


To enable verbose Dynamic Blacklisting log in /var/log/asterisk/messages, make sure that debug messages are included in /etc/asterisk/logger.conf file, for example:
To enable verbose Dynamic Blacklisting log in /var/log/asterisk/messages, and make sure that debug messages are included in /etc/asterisk/logger.conf file, for example:


  messages => notice, warning, error, debug, verbose
  messages => notice, warning, error, debug, verbose


Most of Dynamic Blacklisting log messages are [DEBUG] type messages.
Most Dynamic Blacklisting log messages are [DEBUG] type messages.
 
If you are using a Dynamic Blacklisting script, make sure that the script is executed by cron. Check if /etc/cron.d/mor_blacklisting_script cron is present.
 
Log for the Dynamic Blacklisting script can be found in /var/log/mor/mor_blacklisting_script.log
 
 
 
<br><br>
 
= SIM Blocking =
In some cases, Dynamic Blacklisting functionality can be used for SIM blocking prevention. Such cases are when you know for sure that the operator is using specific calls pattern to detect not-Retail traffic and you know what that pattern is and when Blacklisting functionality supports rules for that pattern. In such cases properly configured rules (individual on each case) '''may''' help.
 
Please note that different operators are using different techniques to detect non-Retail traffic. There is no universal formula or method to prevent SIM Blocking. It is possible that the Operator simply reviews CDRs of specific SIM in order to detect not-Retail traffic. In such case, Blacklisting will not help with SIM blocking anyhow.


If you are using Dynamic Blacklisting script, make sure that script is executed by cron. Check if /etc/cron.d/mor_blacklisting_script cron is present.


Log for Dynamic Blacklisting script can be found in /var/log/mor/mor_blacklisting_script.log
<br><br>


= See also =
= See also =


* [[index.php/Static_Blacklist_and_Whitelist_functionality#Blacklists_.2F_Whitelists|Static Blacklist/Whitelist]]
* [[Static_Blacklist_and_Whitelist_functionality#Blacklists_.2F_Whitelists|Static Blacklist/Whitelist]]
* [[Monitorings Addon]]

Latest revision as of 06:46, 1 December 2022

Dynamic Blacklisting

NOTE: This functionality can be used with a Monitorings Addon enabled only.

Dynamic Blacklist functionality is based on a smart logic that puts a 'score' on the call by its Source Number, Destination Number, and SIP signaling IP and allows routing calls with a high score over a different route.

This functionality gives you the ability to define Blacklist LCR. MOR reroutes all the calls, that have a score more than a defined threshold, to this Blacklist LCR. Dynamic Blacklisting is useful when the system owner wants to route 'suspect' calls through a different route than 'normal' calls.

Example: calls from such countries as Nigeria, Sudan, etc. based on their IP/CallerID can be marked as 'suspects' and routed to some IVR or to the dead-end.

If you are looking for simple Blacklisting implementation, refer to Static Blacklist/Whitelist



Dynamic Blacklisting settings

Dynamic Blacklisting settings are located in ADDONS -> Monitorings -> Dynamic Blacklisting:

Dynamic bl menu.png



How does it work

When calls come to MOR, the system tries to find the score for the Source Number, Destination Number, and SIP signaling IP. These scores are summed into a single value:

TOTAL SCORE = DST SCORE + SRC SCORE + IP SCORE

The total score is compared against the defined Blacklisting Threshold value. If the total score is equal to or higher than the Blacklisting Threshold value, the system changes LCR to the defined Backlisting LCR.

It is important to understand that Dynamic Blacklisting checks all three scores (DST, SRC, and IP) before deciding whether calls should be blacklisted (changed LCR) or not.



Threshold

Before using Dynamic Blacklisting you need to define Blacklisting Threshold values in ADDONS -> Monitoring -> Dynamic Blacklisting -> Settings:

Dynamic bl settings thresholds.png

You can use up to 3 different Threshold values but for simplicity, we will use only the first one.

The calculated Blacklisting total score will be compared to this value. If the calculated Blacklisting total score is equal to or higher than 100, the User’s current LCR will be changed to Blacklisting LCR. If the total score is lower than 100, the User’s LCR will not be changed.



Blacklisting LCR

When the calculated Blacklisting score is higher than Blacklisting Threshold, User’s LCR is changed to Blacklisting LCR.

This LCR may contain specific Providers or can be completely empty. In case of an empty LCR, the call will be hangup with the code:

204	No suitable providers found



How score is calculated

When a call comes to MOR, the Blacklisting score is calculated by finding the score for SRC, DST, and IP in the Blacklisting database.

For example, let’s explain how the score is calculated for the Destination Number (DST). Source and IP score is calculated in the same way.

When a new number is dialed and it is not yet in the Blacklisting database, MOR tries to assign a score to the number by checking the Blacklisting prefix database, which can be defined in ADDONS -> Monitoring -> Dynamic Blacklisting -> Destinations (DST) -> Prefix scores:

Dynamic bl prefix scores.png

For example, if someone dials 93xxxxxx, MOR assigns a score of 70 to this number and puts this number along with the score into the Blacklisting database. Next time this number is dialed, MOR will know the score by looking in the Blacklisting database.

What happens when the score is not set for the prefix? For example, if someone dials 370xxxx but the Prefix scores database does not have a prefix for this number, then the default score will be used. You can set default score in ADDONS -> Monitoring -> Dynamic Blacklisting -> Settings:

Dynamic bl settings default scores.png

Note: numbers with default scores will not be saved to the Blacklisting database. The system will assume that numbers that are not present in the Blacklisting database have a default score and use that score when calculating the Blacklisting score.

The same principle is used for SRC and IP score - when call comes MOR, Dynamic Blacklisting checks if DST/SRC/IP is in Backlisting database, if not then check if prefix exists in Blacklisting prefixes database, if not then uses default Blacklisting score.

These 3 scores are summed (DST score + SRC score + IP Score) and compared against the Blacklisting Threshold value. If the total score is equal or higher, then User’s LCR will be changed to Blacklisting LCR.

If you use only DST blacklisting, you may leave Default SRC and Default IP scores 0. This way it will be easier to calculate the Blacklisting score (DST score + 0 + 0).



Blacklisting database

You can check already blacklisted numbers in ADDONS -> Monitoring -> Dynamic Blacklisting -> Destinations (DST):

Dynamic bl scores.png

On this page, you can find, add, update or delete numbers.

If you want to import numbers to the Blacklisting database, use the following format in a CSV file:

number1;score
number2;score
number3;score



SIP signaling IP

Due to technical limitations, Dynamic Blacklisting will use SIP signaling IP which may be different from the RTP (media) of the Originator.

Dynamic Blacklisting for specific Users

Dynamic Blacklisting blacklisting can be enabled globally for all Users or for specific Users only.

If you want to enable Dynamic Blacklisting globally, go to ADDONS -> Monitoring -> Dynamic Blacklisting -> Settings and check Blacklist Feature enabled checkbox.

If you want to enable Dynamic Blacklisting for a specific User, go to the User’s edit page and change settings under Blacklisting / Whitelisting section:

Dynamic bl user settings.png



Dynamic Blacklisting script (advanced)

Dynamic Blacklisting script allows to add numbers to the Dynamic Blacklisting database based on Blacklisting rules.

Some examples of Blacklisting rules:

  • Set score 100 to DST number if there are 2 or more calls during 5 minutes to the same number
  • Set score 100 to DST number if there are 5 or more calls with a duration lower than 30 seconds to the same number
  • Set score 100 to DST number if there are 3 or more calls to the same number and the number length is lower than 6 digits

The minimal check time is 1 minute (you cannot create a rule 'set score X if there are 10 or more calls during 30 seconds). Maximum time 24 hours. The script is set to run every minute, so if the script is set to block new calls as in 1st example, the script will check if calls should be blocked every minute.


These rules are defined in:

/usr/local/mor/blacklist.conf

The configuration file contains all rules with examples:

; Rules have the following structure: 
;
; type,prefix,count,period,score
;
; type   - type of rule (src/dst/ip/dstsrc/dstduration/srcduration/srclength/dstlength/srcbldst)
; prefix - prefix or keyword (only for src) used to match the target (src/dst/ip)
; count  - how many TIMES this target can be dialed/make calls during specified period of time (in minutes), before this rule is applied
; period - defines the PERIOD of time (in minutes) which is used to check calls (takes all calls made within last X minutes)
; score  - score that will be ADDED to previous score of the target
;
; Note1: to match all the targets of the same rule type, use * symbol instead of prefix
; Note2: in case of dstduration and srcduration, count is time in seconds of a call
; Note3: in case of dstlength and srclength, count is the length of the number
; Note4: in case of dstsrc rule, you can you EMPTY keyword instead prefix. This allows to block dst if numbers without src are calling to this dst
; Note5: in case of srcbldst rule, count is blacklisting score of dst number
;
; Rule types explained


; Type: src
; Description: put a score on src, based on src number and number of calls FROM that src in a defined time period
;
; Examples:
;
; src,mor,1,5,10
; src,1001,1,10,20
;
; Examples explained:
;
; 1. If src 'accountant_mor_25' makes 1 or more calls during 5 minutes period, its blacklisting score will be updated by 10
; 2. If src '1001' makes 1 or more calls during 10 minutes period, its blacklisting score will be updated by 20


; Type: dst
; Description: put a score on dst, based on dst number and number of calls TO that dst in a defined time period
;
; Examples:
;
; dst,370,5,60,50
; dst,37621,5,60,30
; dst,*,10,10,10
;
; Examples explained:
;
; 1. If dst '37062255555' is dialed 5 or more times during 60 minutes period, its blacklisting score will be increased by 50
; 2. If dst '37062155555' is dialed 5 or more times during 60 minutes period, its blacklisting score will be increased by 30
; 3. If any dst is dialed 10 or more times during 10 minutes period, its blacklisting score will be increased by 10


; Type: IP
; Description: put a score on ip, based on ip address and number of calls FROM that ip address in a defined time period
;
; Examples:
;
; ip,78.35,1,15,1
;
; Examples explained:
;
; 1. If ip '78.35.45.21' makes 1 or more calls during 15 minutes period, its blacklisting score will be increased by 1


; Type: dstsrc
; Description: put a score on dst, based on src number and number of calls FROM that src in a defined time period
;
; Examples:
;
; dstsrc,anonymous,1,5,50
; dstsrc,EMPTY,1,5,50
; 
; 1. If src 'anonymous' makes 1 or more calls during 5 minutes period, then blacklisting score will be increased by 50 TO THE NUMBER USER HAS DIALED (dst number)
; 2. If call with no src makes 1 or more calls during 5 minutes period, then blacklisting score will be increased by 50 TO THE NUMBER USER HAS DIALED (dst number)


; Type: dstduration
; Description: put a score on dst, based on lowest call duration to this dst number in a defined time period
;
; Examples:
;
; dstduration,370,30,5,45
; 
; 1. If within last 5 minutes there are calls to dst number 370xxxxxx that have duration shorter than 30 seconds, then dst number's score will be increased by 45


; Type: srcduration
; Description: put a score on src, based on lowest call duration from this src number in a defined time period
;
; Examples:
;
; srcduration,*,60,1,45
; 
; 1. If within last minute there are calls from any src number that have duration shorter than 60 seconds, then src number's score will be increased by 45


; Type: dstlength
; Description: put a score on dst, based on length of dst number and number of calls to this dst in a defined time period
;
; Examples:
;
; dstlength,*,6,1,10
; 
; 1. If within last minute there are calls to any dst number that has length shorter or equal to 6 charaters, then dst number's score will be increased by 10
;
; In this case:
;
; Number 370621 will be blacklisted
; Number 3706215 will not be blacklisted


; Type: srclength
; Description: put a score on src, based on length of src number and number of calls to this dst in a defined time period
;
; Examples:
;
; srclength,*,2,5,30
; 
; 1. If within last 5 minutes there are calls from any src number that has length shorter or equal to 2 charaters, then src number's score will be increased by 30


; Type: srcbldst
; Description: put a score on src if user calls to dst which has equal or higher score than defined
;
; Examples:
;
; srcbldst,*,60,2,30
;
; 1. If within last 2 minutes any src number made a call to dst which has blacklisting score 60 or higher, then src number's score will be increased by 30 


; To comment out a rule, use ; character before rule
;
; Note: only one rule will be applied to the same src/dst/ip so rules should be ordered by prefix length (from longest to shortest (or *))

; Rules start here, please modify them

Add your rules at the end of blacklist.conf file.

Note that examples in your configuration file might be outdated, therefore use examples from this page.

This script can be enabled or disabled at any time. Check Enable Dynamic Blacklisting script checkbox in ADDONS -> Monitoring -> Dynamic Blacklisting -> Settings:

Dynamic bl settings enable script.png

Note that the script does not work in real-time and blacklisted numbers are added to the Blacklisting database within a minute or two.

Also, only a single rule is applied to the same number at a time so order your rules by priority.



Troubleshooting

To enable verbose Dynamic Blacklisting log in /var/log/asterisk/messages, and make sure that debug messages are included in /etc/asterisk/logger.conf file, for example:

messages => notice, warning, error, debug, verbose

Most Dynamic Blacklisting log messages are [DEBUG] type messages.

If you are using a Dynamic Blacklisting script, make sure that the script is executed by cron. Check if /etc/cron.d/mor_blacklisting_script cron is present.

Log for the Dynamic Blacklisting script can be found in /var/log/mor/mor_blacklisting_script.log




SIM Blocking

In some cases, Dynamic Blacklisting functionality can be used for SIM blocking prevention. Such cases are when you know for sure that the operator is using specific calls pattern to detect not-Retail traffic and you know what that pattern is and when Blacklisting functionality supports rules for that pattern. In such cases properly configured rules (individual on each case) may help.

Please note that different operators are using different techniques to detect non-Retail traffic. There is no universal formula or method to prevent SIM Blocking. It is possible that the Operator simply reviews CDRs of specific SIM in order to detect not-Retail traffic. In such case, Blacklisting will not help with SIM blocking anyhow.




See also