Dynamic Blacklist Functionality

Dynamic Blacklisting

NOTE: This functionality can be used with a Monitorings Addon enabled only.

Dynamic Blacklist functionality is based on a smart logic that puts a 'score' on the call by its Source Number, Destination Number, and SIP signaling IP and allows routing calls with a high score over a different route.

This functionality gives you the ability to define Blacklist LCR. MOR reroutes all the calls, that have a score more than a defined threshold, to this Blacklist LCR. Dynamic Blacklisting is useful when the system owner wants to route 'suspect' calls through a different route than 'normal' calls.

Example: calls from such countries as Nigeria, Sudan, etc. based on their IP/CallerID can be marked as 'suspects' and routed to some IVR or to the dead-end.

If you are looking for simple Blacklisting implementation, refer to Static Blacklist/Whitelist

Dynamic Blacklisting settings

Dynamic Blacklisting settings are located in ADDONS -> Monitorings -> Dynamic Blacklisting:

How does it work

When calls come to MOR, the system tries to find the score for the Source Number, Destination Number, and SIP signaling IP. These scores are summed into a single value:

TOTAL SCORE = DST SCORE + SRC SCORE + IP SCORE

The total score is compared against the defined Blacklisting Threshold value. If the total score is equal to or higher than the Blacklisting Threshold value, the system changes LCR to the defined Backlisting LCR.

It is important to understand that Dynamic Blacklisting checks all three scores (DST, SRC, and IP) before deciding whether calls should be blacklisted (changed LCR) or not.

Threshold

Before using Dynamic Blacklisting you need to define Blacklisting Threshold values in ADDONS -> Monitoring -> Dynamic Blacklisting -> Settings:

You can use up to 3 different Threshold values but for simplicity, we will use only the first one.

The calculated Blacklisting total score will be compared to this value. If the calculated Blacklisting total score is equal to or higher than 100, the User’s current LCR will be changed to Blacklisting LCR. If the total score is lower than 100, the User’s LCR will not be changed.

Blacklisting LCR

When the calculated Blacklisting score is higher than Blacklisting Threshold, User’s LCR is changed to Blacklisting LCR.

This LCR may contain specific Providers or can be completely empty. In case of an empty LCR, the call will be hangup with the code:

204	No suitable providers found

How score is calculated

When a call comes to MOR, the Blacklisting score is calculated by finding the score for SRC, DST, and IP in the Blacklisting database.

For example, let’s explain how the score is calculated for the Destination Number (DST). Source and IP score is calculated in the same way.

When a new number is dialed and it is not yet in the Blacklisting database, MOR tries to assign a score to the number by checking the Blacklisting prefix database, which can be defined in ADDONS -> Monitoring -> Dynamic Blacklisting -> Destinations (DST) -> Prefix scores:

For example, if someone dials 93xxxxxx, MOR assigns a score of 70 to this number and puts this number along with the score into the Blacklisting database. Next time this number is dialed, MOR will know the score by looking in the Blacklisting database.

What happens when the score is not set for the prefix? For example, if someone dials 370xxxx but the Prefix scores database does not have a prefix for this number, then the default score will be used. You can set default score in ADDONS -> Monitoring -> Dynamic Blacklisting -> Settings:

Note: numbers with default scores will not be saved to the Blacklisting database. The system will assume that numbers that are not present in the Blacklisting database have a default score and use that score when calculating the Blacklisting score.

The same principle is used for SRC and IP score - when call comes MOR, Dynamic Blacklisting checks if DST/SRC/IP is in Backlisting database, if not then check if prefix exists in Blacklisting prefixes database, if not then uses default Blacklisting score.

These 3 scores are summed (DST score + SRC score + IP Score) and compared against the Blacklisting Threshold value. If the total score is equal or higher, then User’s LCR will be changed to Blacklisting LCR.

If you use only DST blacklisting, you may leave Default SRC and Default IP scores 0. This way it will be easier to calculate the Blacklisting score (DST score + 0 + 0).

Blacklisting database

You can check already blacklisted numbers in ADDONS -> Monitoring -> Dynamic Blacklisting -> Destinations (DST):

On this page, you can find, add, update or delete numbers.

If you want to import numbers to the Blacklisting database, use the following format in a CSV file:

number1;score
number2;score
number3;score

SIP signaling IP

Due to technical limitations, Dynamic Blacklisting will use SIP signaling IP which may be different from the RTP (media) of the Originator.

Dynamic Blacklisting for specific Users

Dynamic Blacklisting blacklisting can be enabled globally for all Users or for specific Users only.

If you want to enable Dynamic Blacklisting globally, go to ADDONS -> Monitoring -> Dynamic Blacklisting -> Settings and check Blacklist Feature enabled checkbox.

If you want to enable Dynamic Blacklisting for a specific User, go to the User’s edit page and change settings under Blacklisting / Whitelisting section:

Dynamic Blacklisting script (advanced)

Dynamic Blacklisting script allows to add numbers to the Dynamic Blacklisting database based on Blacklisting rules.

Some examples of Blacklisting rules:

• Set score 100 to DST number if there are 2 or more calls during 5 minutes to the same number
• Set score 100 to DST number if there are 5 or more calls with a duration lower than 30 seconds to the same number
• Set score 100 to DST number if there are 3 or more calls to the same number and the number length is lower than 6 digits

The minimal check time is 1 minute (you cannot create a rule 'set score X if there are 10 or more calls during 30 seconds). Maximum time 24 hours. The script is set to run every minute, so if the script is set to block new calls as in 1st example, the script will check if calls should be blocked every minute.

These rules are defined in:

/usr/local/mor/blacklist.conf

The configuration file contains all rules with examples:

; Rules have the following structure: 
;
; type,prefix,count,period,score
;
; type   - type of rule (src/dst/ip/dstsrc/dstduration/srcduration/srclength/dstlength/srcbldst)
; prefix - prefix or keyword (only for src) used to match the target (src/dst/ip)
; count  - how many TIMES this target can be dialed/make calls during specified period of time (in minutes), before this rule is applied
; period - defines the PERIOD of time (in minutes) which is used to check calls (takes all calls made within last X minutes)
; score  - score that will be ADDED to previous score of the target
;
; Note1: to match all the targets of the same rule type, use * symbol instead of prefix
; Note2: in case of dstduration and srcduration, count is time in seconds of a call
; Note3: in case of dstlength and srclength, count is the length of the number
; Note4: in case of dstsrc rule, you can you EMPTY keyword instead prefix. This allows to block dst if numbers without src are calling to this dst
; Note5: in case of srcbldst rule, count is blacklisting score of dst number
;
; Rule types explained


; Type: src
; Description: put a score on src, based on src number and number of calls FROM that src in a defined time period
;
; Examples:
;
; src,mor,1,5,10
; src,1001,1,10,20
;
; Examples explained:
;
; 1. If src 'accountant_mor_25' makes 1 or more calls during 5 minutes period, its blacklisting score will be updated by 10
; 2. If src '1001' makes 1 or more calls during 10 minutes period, its blacklisting score will be updated by 20


; Type: dst
; Description: put a score on dst, based on dst number and number of calls TO that dst in a defined time period
;
; Examples:
;
; dst,370,5,60,50
; dst,37621,5,60,30
; dst,*,10,10,10
;
; Examples explained:
;
; 1. If dst '37062255555' is dialed 5 or more times during 60 minutes period, its blacklisting score will be increased by 50
; 2. If dst '37062155555' is dialed 5 or more times during 60 minutes period, its blacklisting score will be increased by 30
; 3. If any dst is dialed 10 or more times during 10 minutes period, its blacklisting score will be increased by 10


; Type: IP
; Description: put a score on ip, based on ip address and number of calls FROM that ip address in a defined time period
;
; Examples:
;
; ip,78.35,1,15,1
;
; Examples explained:
;
; 1. If ip '78.35.45.21' makes 1 or more calls during 15 minutes period, its blacklisting score will be increased by 1


; Type: dstsrc
; Description: put a score on dst, based on src number and number of calls FROM that src in a defined time period
;
; Examples:
;
; dstsrc,anonymous,1,5,50
; dstsrc,EMPTY,1,5,50
; 
; 1. If src 'anonymous' makes 1 or more calls during 5 minutes period, then blacklisting score will be increased by 50 TO THE NUMBER USER HAS DIALED (dst number)
; 2. If call with no src makes 1 or more calls during 5 minutes period, then blacklisting score will be increased by 50 TO THE NUMBER USER HAS DIALED (dst number)


; Type: dstduration
; Description: put a score on dst, based on lowest call duration to this dst number in a defined time period
;
; Examples:
;
; dstduration,370,30,5,45
; 
; 1. If within last 5 minutes there are calls to dst number 370xxxxxx that have duration shorter than 30 seconds, then dst number's score will be increased by 45


; Type: srcduration
; Description: put a score on src, based on lowest call duration from this src number in a defined time period
;
; Examples:
;
; srcduration,*,60,1,45
; 
; 1. If within last minute there are calls from any src number that have duration shorter than 60 seconds, then src number's score will be increased by 45


; Type: dstlength
; Description: put a score on dst, based on length of dst number and number of calls to this dst in a defined time period
;
; Examples:
;
; dstlength,*,6,1,10
; 
; 1. If within last minute there are calls to any dst number that has length shorter or equal to 6 charaters, then dst number's score will be increased by 10
;
; In this case:
;
; Number 370621 will be blacklisted
; Number 3706215 will not be blacklisted


; Type: srclength
; Description: put a score on src, based on length of src number and number of calls to this dst in a defined time period
;
; Examples:
;
; srclength,*,2,5,30
; 
; 1. If within last 5 minutes there are calls from any src number that has length shorter or equal to 2 charaters, then src number's score will be increased by 30


; Type: srcbldst
; Description: put a score on src if user calls to dst which has equal or higher score than defined
;
; Examples:
;
; srcbldst,*,60,2,30
;
; 1. If within last 2 minutes any src number made a call to dst which has blacklisting score 60 or higher, then src number's score will be increased by 30 


; To comment out a rule, use ; character before rule
;
; Note: only one rule will be applied to the same src/dst/ip so rules should be ordered by prefix length (from longest to shortest (or *))

; Rules start here, please modify them

Add your rules at the end of blacklist.conf file.

Note that examples in your configuration file might be outdated, therefore use examples from this page.

This script can be enabled or disabled at any time. Check Enable Dynamic Blacklisting script checkbox in ADDONS -> Monitoring -> Dynamic Blacklisting -> Settings:

Note that the script does not work in real-time and blacklisted numbers are added to the Blacklisting database within a minute or two.

Also, only a single rule is applied to the same number at a time so order your rules by priority.

Troubleshooting

To enable verbose Dynamic Blacklisting log in /var/log/asterisk/messages, and make sure that debug messages are included in /etc/asterisk/logger.conf file, for example:

messages => notice, warning, error, debug, verbose

Most Dynamic Blacklisting log messages are [DEBUG] type messages.

If you are using a Dynamic Blacklisting script, make sure that the script is executed by cron. Check if /etc/cron.d/mor_blacklisting_script cron is present.

Log for the Dynamic Blacklisting script can be found in /var/log/mor/mor_blacklisting_script.log

SIM Blocking

In some cases, Dynamic Blacklisting functionality can be used for SIM blocking prevention. Such cases are when you know for sure that the operator is using specific calls pattern to detect not-Retail traffic and you know what that pattern is and when Blacklisting functionality supports rules for that pattern. In such cases properly configured rules (individual on each case) may help.

Please note that different operators are using different techniques to detect non-Retail traffic. There is no universal formula or method to prevent SIM Blocking. It is possible that the Operator simply reviews CDRs of specific SIM in order to detect not-Retail traffic. In such case, Blacklisting will not help with SIM blocking anyhow.

See also

• Static Blacklist/Whitelist
• Monitorings Addon