Dynamic Blacklist Functionality

Dynamic Blacklisting

NOTE: This functionality can be used with a Monitorings Addon enabled only.

Dynamic Blacklist functionality is based on a smart logic which puts a 'score' on the call by its Source Number, Destination Number and SIP signaling IP and allows routing calls with high score over different route.

This functionality gives you ability to define Blacklist LCR. MOR reroutes all the calls, that have a score more than a defined threshold, to this Blacklist LCR. Dynamic Blacklisting is useful when system owner wants to route 'suspect' calls through different route than 'normal' calls.

Example: calls from such countries as Nigeria, Sudan, etc. based on their IP/CallerID can be marked as 'suspects' and routed to some IVR or to the dead-end.

If you are looking for simple Blacklisting implementation, refer to Static Blacklist/Whitelist

Dynamic Blacklisting settings

Dynamic Blacklisting settings are located in ADDONS -> Monitorings -> Dynamic Blacklisting:

How does it work

When calls come to MOR, system tries to find score for Source Number, Destination Number and SIP signaling IP. These scores are summed into single value:

TOTAL SCORE = DST SCORE + SRC SCORE + IP SCORE

Then total score is compared against defined Blacklisting Threshold value. If total score is equal or higher than Blacklisting Threshold value, system changes LCR to defined Backlisting LCR.

It is important to understand that Dynamic Blacklisting checks all three scores (DST, SRC and IP) before deciding whether call should be blacklisted (changed LCR) or not.

Threshold

Before using Dynamic Blacklisting you need to define Blacklisting Threshold values in ADDONS -> Monitoring -> Dynamic Blacklisting -> Settings:

You can use up to 3 different Threshold values but for simplicity we will use only first one.

Calculated Blacklisting total score will be compared to this value. If calculated Blacklisting total score is equal or higher than 100, User’s current LCR will be changed to Blacklisting LCR. If total score is lower than 100, User’s LCR will not be changed.

Blacklisting LCR

When calculated Blacklisting score is higher than Blacklisting Threshold, User’s LCR is changed to Blacklisting LCR.

This LCR may contain specific Providers or can be completely empty. In case of empty LCR, call will be hangup with code:

204	No suitable providers found

How score is calculated

When call comes to MOR, Blacklisting score is calculated by finding score for SRC, DST and IP in Blacklisting database.

For example, let’s explain how score is calculated for Destination Number (DST). Source and IP score is calculated in the same way.

When new number is dialed and it is not yet in Blacklisting database, MOR tries to assign score to number by checking Blacklisting prefix database, which can de defined in ADDONS -> Monitoring -> Dynamic Blacklisting -> Destinations (DST) -> Prefix scores:

For example, if someone dials 93xxxxxx, MOR assigns score 70 to this number and puts this number along with score to Blacklisting database. Next time this number is dialed, MOR will know score by looking in Blacklisting database.

What happens when score is not set for prefix? For example, if someone dials 370xxxx but Prefix scores database does not have prefix for this number, then default score will be used. You can set default score in ADDONS -> Monitoring -> Dynamic Blacklisting -> Settings:

Note: numbers with default score will not be saved to Blacklisting database. System will assume that numbers that are not present in Blacklisting database have default score and use that score when calculating Blacklisting score.

Same principle is used for SRC and IP score - when call comes MOR, Dynamic Blacklisting checks if DST/SRC/IP is in Backlisting database, if not then checks if prefix exists in Blacklisting prefixes database, if not then uses default Blacklisting score.

These 3 scores are summed (DST score + SRC score + IP Score) and compared against Blacklisting Threshold value. If total score is equal or higher, then User’s LCR will be changed to Blacklisting LCR.

If you use only DST blacklisting, you may leave Default SRC and Default IP scores 0. This way it will be easier to calculate Blacklisting score (DST score + 0 + 0).

Blacklisting database

You can check already blacklisted numbers in ADDONS -> Monitoring -> Dynamic Blacklisting -> Destinations (DST):

In this page you can find, add, update or delete numbers.

If you want to import numbers to Blacklisting database, use following format in CSV file:

number1;score
number2;score
number3;score

SIP signaling IP

Due to technical limitations, Dynamic Blacklisting will use SIP signaling IP which may be different from RTP (media) of Originator.

Dynamic Blacklisting for specific Users

Dynamic Blacklisting blacklisting can be enabled globally to all Users or for specific Users only.

If you want to enable Dynamic Blacklisting globally, go to ADDONS -> Monitoring -> Dynamic Blacklisting -> Settings and check Blacklist Feature enabled checkbox.

If you want to enable Dynamic Blacklisting for specific User, go to User’s edit page and change settings under Blacklisting / Whitelisting section:

Dynamic Blacklisting script (advanced)

Dynamic Blacklisting script allows to add numbers to Dynamic Blacklisting database based on Blacklisting rules.

Some examples of Blacklisting rules:

• Set score 100 to DST number if there are 2 or more calls during 5 minutes to the same number
• Set score 100 to DST number if there are 5 or more calls with duration lower than 30 seconds to the same number
• Set score 100 to DST number if there are 3 or more calls to the same number and number length is lower than 6 digits

Minimal check time is 1 minute (you cannot create rule 'set score X if there are 10 or more calls during 30 seconds'). Maximum time 24 hours. The script is set to run every minute, so if script is set to block new calls as in 1st example, script will check if calls should be blocked every minute.

These rules are defined in:

/usr/local/mor/blacklist.conf

Configuration file contains all rules with examples:

; Rules have the following structure: 
;
; type,prefix,count,period,score
;
; type   - type of rule (src/dst/ip/dstsrc/dstduration/srcduration/srclength/dstlength/srcbldst)
; prefix - prefix or keyword (only for src) used to match the target (src/dst/ip)
; count  - how many TIMES this target can be dialed/make calls during specified period of time (in minutes), before this rule is applied
; period - defines the PERIOD of time (in minutes) which is used to check calls (takes all calls made within last X minutes)
; score  - score that will be ADDED to previous score of the target
;
; Note1: to match all the targets of the same rule type, use * symbol instead of prefix
; Note2: in case of dstduration and srcduration, count is time in seconds of a call
; Note3: in case of dstlength and srclength, count is the length of the number
; Note4: in case of dstsrc rule, you can you EMPTY keyword instead prefix. This allows to block dst if numbers without src are calling to this dst
; Note5: in case of srcbldst rule, count is blacklisting score of dst number
;
; Rule types explained


; Type: src
; Description: put a score on src, based on src number and number of calls FROM that src in a defined time period
;
; Examples:
;
; src,mor,1,5,10
; src,1001,1,10,20
;
; Examples explained:
;
; 1. If src 'accountant_mor_25' makes 1 or more calls during 5 minutes period, its blacklisting score will be updated by 10
; 2. If src '1001' makes 1 or more calls during 10 minutes period, its blacklisting score will be updated by 20


; Type: dst
; Description: put a score on dst, based on dst number and number of calls TO that dst in a defined time period
;
; Examples:
;
; dst,370,5,60,50
; dst,37621,5,60,30
; dst,*,10,10,10
;
; Examples explained:
;
; 1. If dst '37062255555' is dialed 5 or more times during 60 minutes period, its blacklisting score will be increased by 50
; 2. If dst '37062155555' is dialed 5 or more times during 60 minutes period, its blacklisting score will be increased by 30
; 3. If any dst is dialed 10 or more times during 10 minutes period, its blacklisting score will be increased by 10


; Type: IP
; Description: put a score on ip, based on ip address and number of calls FROM that ip address in a defined time period
;
; Examples:
;
; ip,78.35,1,15,1
;
; Examples explained:
;
; 1. If ip '78.35.45.21' makes 1 or more calls during 15 minutes period, its blacklisting score will be increased by 1


; Type: dstsrc
; Description: put a score on dst, based on src number and number of calls FROM that src in a defined time period
;
; Examples:
;
; dstsrc,anonymous,1,5,50
; dstsrc,EMPTY,1,5,50
; 
; 1. If src 'anonymous' makes 1 or more calls during 5 minutes period, then blacklisting score will be increased by 50 TO THE NUMBER USER HAS DIALED (dst number)
; 2. If call with no src makes 1 or more calls during 5 minutes period, then blacklisting score will be increased by 50 TO THE NUMBER USER HAS DIALED (dst number)


; Type: dstduration
; Description: put a score on dst, based on lowest call duration to this dst number in a defined time period
;
; Examples:
;
; dstduration,370,30,5,45
; 
; 1. If within last 5 minutes there are calls to dst number 370xxxxxx that have duration shorter than 30 seconds, then dst number's score will be increased by 45


; Type: srcduration
; Description: put a score on src, based on lowest call duration from this src number in a defined time period
;
; Examples:
;
; srcduration,*,60,1,45
; 
; 1. If within last minute there are calls from any src number that have duration shorter than 60 seconds, then src number's score will be increased by 45


; Type: dstlength
; Description: put a score on dst, based on length of dst number and number of calls to this dst in a defined time period
;
; Examples:
;
; dstlength,*,6,1,10
; 
; 1. If within last minute there are calls to any dst number that has length shorter or equal to 6 charaters, then dst number's score will be increased by 10
;
; In this case:
;
; Number 370621 will be blacklisted
; Number 3706215 will not be blacklisted


; Type: srclength
; Description: put a score on src, based on length of src number and number of calls to this dst in a defined time period
;
; Examples:
;
; srclength,*,2,5,30
; 
; 1. If within last 5 minutes there are calls from any src number that has length shorter or equal to 2 charaters, then src number's score will be increased by 30


; Type: srcbldst
; Description: put a score on src if user calls to dst which has equal or higher score than defined
;
; Examples:
;
; srcbldst,*,60,2,30
;
; 1. If within last 2 minutes any src number made a call to dst which has blacklisting score 60 or higher, then src number's score will be increased by 30 


; To comment out a rule, use ; character before rule
;
; Note: only one rule will be applied to the same src/dst/ip so rules should be ordered by prefix length (from longest to shortest (or *))

; Rules start here, please modify them

Add your rules at the end of blacklist.conf file.

Note that examples in your configuration file might be outdated, thefore use examples from this page.

This script can be enabled or disabled at any time. Check Enable Dynamic Blacklisting script checkbox in ADDONS -> Monitoring -> Dynamic Blacklisting -> Settings:

Note that script does not work in realtime and blacklisted numbers are added to Blacklisting database within a minute or two.

Also, only single rule is applied to the same number at a time so order you rules by priority.

Troubleshooting

To enable verbose Dynamic Blacklisting log in /var/log/asterisk/messages, make sure that debug messages are included in /etc/asterisk/logger.conf file, for example:

messages => notice, warning, error, debug, verbose

Most of Dynamic Blacklisting log messages are [DEBUG] type messages.

If you are using Dynamic Blacklisting script, make sure that script is executed by cron. Check if /etc/cron.d/mor_blacklisting_script cron is present.

Log for Dynamic Blacklisting script can be found in /var/log/mor/mor_blacklisting_script.log

SIM Blocking

In some cases Dynamic Blacklisting functionality can be used for SIM blocking prevention. Such cases are when you know for sure that operator is using specific calls pattern to detect not-Retail traffic and you know what that pattern is and when Blacklisting functionality supports rules for that pattern. In such case properly configured rules (individual on each case) may help.

Please note that different operators are using different techniques to detect non-Retail traffic. There is no universal formula or method to prevent SIM Blocking. It is possible that Operator simply reviews CDRs of specific SIM in order to detect not-Retail traffic. In such case Blacklisting will not help with SIM blocking anyhow.

See also

• Static Blacklist/Whitelist