Here are some of the common questions we’re getting.

What kind of fraud does FraudStopper stop?
FraudStopper is intended for the most prevalent form of Toll Fraud for VoIP Carriers. In most scenarios, someone has VoIP service with no SIP authentication, or very weak SIP credentials. For example, the password might be, literally, “password”. Criminals discover this account via the Internet, then take over that user’s account and place expensive outbound calls.

What are FraudStopper’s thresholds?
Most of the simple Fraud prevention tools are based on simple assumptions about user’s behavior. For example, many of them will alert if they ever see two concurrent International calls from one customer. Or they may alert if they detect more than 5 International calls in a day.

As long as these work, then that’s great. But what about the customer who regularly makes a dozen International calls each day? You have to start building in exceptions.

Instead of building in a lot of exceptions, FraudStopper dynamically and automatically compiles a User Behavior Database of each user’s behavior. So it knows that Fred makes 50 international calls every Tuesday, but almost none on Saturdays. And it knows that Granny never makes an international call.

What versions of FraudStopper are available?
FraudStopper comes in two versions. In both cases, FraudStopper is installed in your own network.

• ECG Trained Analysts. FraudStopper with Human Analysts provides real-time, 24x7x365 monitoring for fraud on your system.
• Your Own Analysts. FraudStopper sends alerts only to your staff.

How is FraudStopper priced?
FraudStopper pricing is based on the number of monitored users, and the type of analyst services you want.

ECG, a VoIP network design and integration consultancy, announces the success of FraudStopper, a new toll-fraud detection system optimized for VoIP providers. FraudStopper was deployed in June 2011 at a nationwide CLEC based in New York City. The system has successfully detected numerous incidents of attempted theft of service, saving the CLEC tens of thousands of dollars in losses for international termination.

VoIP Toll Fraud became a major issue for many carriers in November 2010, when thieves began using the “SIPVicious” security scanning tool to search the Internet for VoIP service that could be stolen. ECG estimates that over US $1M in international termination service has been stolen by criminals targeting VoIP service providers in the United States. Some individual incidents have amounted to more than US $160,000.

Most fraud detection systems have simplistic thresholds to identify risky behavior. If a customer appears to make a large number of international calls, the system will alert automatically. But if that same customer routinely makes a large number of international calls and pays for the service, it could simply be their normal course of business. Such simplistic schemes cannot handle the wide diversity among VoIP customers, some of whom make no international calls, while others make numerous calls.

“FraudStopper learns the normal behavior for customers by analyzing historical billing records to determine what is routine for each individual,” said James Pucket, president of ECG. “Statistics are tracked per customer in the User Behavior Database.  When international calling occurs that does not match a customer’s profile, FraudStopper can detect that change and report the risk.”

However, ordinary activity on a Monday might be fraudulent levels on a Saturday. FraudStopper’s dynamic database understands weekly patterns of work. The User Behavior Database compares details from the day of the week extending far into the past to make accurate judgments and reduce false positives.

Alerting from FraudStopper is done through email and SNMP. The email describes the user suspected of fraud, and the historical profile for the user. This allows operations staff to determine the risk and make a judgment. The SNMP trap allows integration with Network-Management tools like HP OpenView and SolarWinds.

The Real-Time Call Progress Monitor in FraudStopper can receive input data from practically any source. Full integration with real-time or batched data sources is available. ECG has integrated using CDRs from Metaswitch, BroadSoft, Acme Packet, Alcatel-Lucent, and others.

About ECG:

ECG is technical consultancy for VoIP, Telecom, and Internet service providers. The technical staff at ECG have been designing and implementing carrier networks since 1995, and bring the value of their experience through troubleshooting, network integration and more. Major vendors, such as Acme Packet, BroadSoft and Metaswitch use ECG for special projects, while carriers including AT&T, TelePacific and Stage2 Networks use ECG to support their network design and operations. Visit http://www.e-c-group.com/.

About Metaswitch Forum 2011

Now in its eighth year, the Metaswitch Forum is firmly established as a premier event for service providers that are embracing the move to all-IP networking and services. With more than 200 service providers attending from around the world, Metaswitch customers and prospects value the opportunity to talk technology, analyze trends, share marketing ideas and explore solutions at our Mosaic partner expo.   This year’s event looks closely at the impact of customer mobility and the migration to ever more intelligent endpoints interacting with a cloud service core.  Featuring customer, celebrity and executive keynote speakers, specialized tracks and continuous networking opportunities, Forum 2011 runs from October 3-6 at the Bellagio Resort and Casino, Las Vegas.  For more information, visit http://www.metaswitchforum.com/.  Or #mforum2011.

BroadSoft Connections 2010, PHOENIX, October 25, 2010 — Responding to the need for quality instruction for BroadSoft® BroadWorks® operations and engineering teams, ECG’s School of VoIP now offers a new course to provide comprehensive training on BroadWorks Call Processing and Troubleshooting.  Students enrolled in any School of VoIP class gain new skills working with senior ECG engineers with years of experience in advanced VoIP network design and troubleshooting.  These same engineers are also actively providing consulting services to ECG’s clients, so the expertise they bring to the classroom is on the cutting edge of current VoIP technology.  ECG has provided BroadWorks network design and implementation since 2002 at dozens of carriers across the US, Canada, and Caribbean.

A carrier enlisting ECG’s School of VoIP to teach the BroadWorks Call Processing and Troubleshooting class can expect a comprehensive package that extends well beyond traditional classroom instruction.  ECG’s engineer performs an on-site network evaluation to tailor the class to fit the unique needs and products.  ECG’s courses emphasize practical objectives and hands-on lab exercises, so students walk away with skills that can be put into practice immediately.  A 275-page course book developed by ECG is also provided to each student.

The BroadWorks Call Processing and Troubleshooting class covers the following topics in depth: Server Interactions; SIP Call Control In Depth; Analyzing Logs including XSLogs; Packet Captures on BroadWorks Servers; Command-Line Diagnostics with the BroadWorks CLI (bwcli) and ttlsql.

ECG adds the Call Processing and Troubleshooting class to the School of VoIP’s already extensive course catalog.  These classes cover topics such as: Acme Packet SBC operation customized to your network; Broadworks installation and upgrades; IP Foundations for VoIP Carriers; and Advanced VoIP Engineering and Troubleshooting.  For more information on ECG’s School of VoIP visit http://www.e-c-group.com/school-of-voip.

About ECG

ECG, founded in 2001, provides innovative Network Design & Operations Services that address the operational and marketplace challenges faced by today’s telecom providers and large enterprises.  Our clients include Independent Local Exchange Carriers (ILECs), Competitive Local Exchange Carriers (CLECs), Incumbent carriers, wireless carriers, and Internet service providers.  ECG offers Business Services Consulting that includes feasibility studies, interconnection agreements, regulatory reviews, web development, and professional training. We assist our client through every phase of a project from initial design to actual implementation and integration, to ongoing support and troubleshooting. ECG’s School of VoIP provides training by engineers to build skills and comprehension at VoIP Carriers. ECG, Inc. is a privately held company and has been profitable since its inception.  For more information, visit http://www.e-c-group.com/.

About BroadSoft

BroadSoft provides software that enables fixed-line, mobile and cable service providers to deliver voice and multimedia services over their IP-based networks. The Company’s software, BroadWorks^®, enables service providers to provide enterprises and consumers with a range of cloud-based, or hosted, IP multimedia communications, such as hosted IP private branch exchanges, video calling, unified communications, collaboration and converged mobile and fixed-line services.

ECG, a network and systems consulting firm, today announced completed integration of the NGTelsoft Call Rating platform with Metaswitch Call Detail Records. NGTelsoft gives telecom carriers a new choice for their mediation, rating, and billing platforms.

NGTelsoft is one of the first and only platforms available that supplements a carrier’s, utility’s, or ISP’s existing billing system with complete call-rating capability. Service providers can use the platform for virtually any billing system – including online services. Carriers are no longer fenced-in by telecom-specific billing platforms.

NGTelsoft cost-efficiently provides a precise calculation of the cost of calls while maintaining compatibility with existing billing platforms to provide line-item records, and move the complexity to a modern Microsoft SQL Server database. A standard NGTelsoft server can rate 50 million calls per month and runs on standard hardware.

By simplifying provisioning, NGTelesoft’s web interface supports local, long distance, toll-free and services calls plus trunk-group billing and post-paid calling cards. The NGTelsoft does complete digit-analysis of phone calls, and provides the option for sophisticated local calling areas to be assigned to each rate plan. The platform also makes LATA-wide or state-wide local calling easier. The NGTelsoft database has information about all rate centers, LATAs, states and territories in the NANPA region and the complete local calling area for a service provider’s calling area.

Customers can bundle a pool of minutes onto plans with free minutes plans. For example, a plan may provide 500 minutes of free local and long-distance usage every month, then charge normally after that.

NGTelsoft also handles tandem trunk-group billing where the customer’s telephone number cannot be known in advance. Each trunk group can have a different rate plan, and all rate plan changes can be scheduled to occur in advance.

Carriers may run their own NGTelsoft server, or use ECG’s hosting services to operate a dedicated installation. Normal support includes rate-plan updates and maintenance at no additional charge. The NGTelsoft API allows for extension and modification by a carrier’s IT staff.

Three obstacles plague VoIP Carriers. First, the flexibility and complexity of network design options can make network development take many months or years. Second, support for the complex features of SIP Trunking and Hosted PBX create a huge burden on staff. Finally, experienced VoIP engineers and technicians are hard to find, but there are few options for in-depth training.

ECG, a network and systems consulting firm, is changing that. ECG’s experience and speed radically changes the prospects for many VoIP carriers by lowering the costs and delays to deployment, providing access to experts, and enabling staff development.

VoIP networks not only bring amazing flexibility, but also provide unparalleled complexity in network design, quality-of-service, VoIP phone management, Session Border Controller deployments, and reliability. A typical five-person team with a modest VoIP capital expenditure can cost $40,000 per month while they learn and build the system. That home-grown education is tremendously expensive.

ECG shrinks those costs and delays by applying proven best practices for VoIP carriers. Instead of months to deployment, ECG VoIP network design and deployment can take only weeks. One VoIP carrier with services from Michigan to Florida used ECG for just this purpose. ECG analyzed their network and provided detailed assistance improving performance and security.

Once the network is operational, carriers struggle to staff and maintain the network while servicing existing customers. ECG’s solution is to provide on-demand expertise and routine network maintenance. A carrier’s staff can serve existing customers and win new customers, while using ECG for routine maintenance and troubleshooting tasks. A Hosted PBX VoIP carrier based in New York uses ECG for engineering support and technical customer support on a daily basis to free up their staff for hands-on interactions with clients.

VoIP carriers also learn that the skillset for VoIP networks – SBCs, application servers, SIP signaling, QoS Engineering – are not easily found in the job market. Technical staff must be groomed from within. ECG has the only training on industry-standards technology like SIP, MGCP, RTP and session border controllers. A VoIP carrier in Puerto Rico has used ECG’s training to educate Engineering and Operations teams across the company on Network Fundamentals and VoIP Engineering and Troubleshooting.

One of ECG’s long-time clients is Akabis, a nationwide wholesale VoIP provider based in North Carolina. According to Mark Wiles, vice president of engineering, Akabis, “ECG knows their stuff. They are the solution to making all the pieces come together to make VoIP work.”

We responded today to an attack on a nationwide Service Provider. They reported up to 69 REGISTERs per second originating from an IP address in Anhui province, China. 69 REGISTERs per second is roughly the equivalent load of 5,000 users.

Unfortunately for the victims, the “friendly scanner”, SIPVicious runs very hot and fast, apparently blasting out lots of requests without even waiting for earlier attempts to fail. The SIPVicious tool is focused on cracking SIP PBXs, and will be only so slightly less effective on Carrier VoIP systems.

The main reports of problems due to SIP Registration scanning are server overloads. But if the registration scanner users are smart, they’ll slow down their rates so they don’t alarm the parties being probed.

How do you defend against SIP Registration storms?

1. For registering endpoints like SIP phones and IADs always use SIP authentication! use quality passwords.
2. If you have a competent Session Border Controller like the Acme Packet OS-C system, you can blacklist devices after they fail a few REGISTER attempts.
3. If you’re using non-registering SIP (such as SIP peerings for SIP Trunking), you should have a small number of SIP signaling IP addresses. Use firewall rules / or ACLs to block all SIP except for what comes from that small list.
4. Use heavy-hitter detectors to spot SIP devices that are sending more-than-normal traffic loads, and alarm your staff.

Many Hosted PBX providers based on VoIP are surprised by the network load caused by the SIP Features “Shared Call Appearance” (SCA), “Shared Line Appearance”, “Simultaneous Ring”, “Busy Lamp Field” (BLF), or “Line State Monitoring”. Both of the big Application Server players, Metaswitch and BroadSoft, offer these features. And carriers are starting to deploy them in spades. They’re often together, so I’ll call them collectively BLF/SCA/Simring.

All these features are fundamental departures in the underlying signaling model. I’ll explain why, and what a VoIP Service Provider needs to do.

1,000% Increase in Signaling

Normal Modern call control requires only a few signaling SIP messages to setup or end a telephone call: INVITE, 100, 180, PRACK, 200, 200, ACK, BYE, 200. You’ll get more messages when calls are put on hold, or switch to fax mode, and Metaswitch does session-audits with a re-INVITE every 30 seconds. But 10 or 20 messages are typical for a phone call.

Enter BLF/SCA. Now every phone in the group can get 6 or more NOTIFY-200 SIP messages for every call placed by other people in the group. Plus they get a call setup attempt for every single call for every person in their group.

The SIP signaling load per user grows enormously. A user who has 20 calls per day might only need 200 signaling messages for call control, but a user in a 5-person BLF/SCA group could have 1,100 messages per day. Raise that to ten-person group, and now it’s 2,180 messages per day.

The signaling load grows superlinearly — in this case, it grows as n² with the number of users in the group!

Surprise! Your system is full earlier than expected.

The real danger is not the messages per day — it’s the messages per second at your peak. If your customers are clustered into one geographic area, that peak probably happens around 10:00am or 3:00pm local time. But for typical users, peak load will correspond to the daily workload.

And the problem is typically not in the routers and switches; signaling load is just more IP traffic. Solving problems in the transport network would be easy. But signaling load affects the application plane — i.e., the devices that process the SIP. Solving application-layer problems is much more complex, because (obviously) the application has to track the state and progress of all of the user-oriented business logic.

So what is most likely to get overloaded during the peak?

1. The Session Border Controller.
   Even some folks at the SBC vendor have been caught off-guard in a few cases by this. In one case, a sales engineer told me that he had planned for a single SBC installation, but needed 3x SBC systems to handle all the BLF/SCA traffic. “The planning tool we had was all wrong,” he said.
2. The Application Server.
   When you’re using BLF/SCA, the AS or Call Feature Server (CFS) may have to process 10x as many SIP dialogs, and has to handle 10x as many SIP messages. “The most expensive thing an Application Server does is process a SIP packets,” a BroadSoft Systems Engineer once told me.

BLF/SCA and Simultaneous Ring are certainly very useful — but they come with a price.

Cool features — Big cost differences.

For example: suppose an SBC costs $67,500 for a non-redundant system and three years of support. Without BLF/SCA/Simultaneous Ring, you could expect to support 30,000 users on the system; i.e., that’s $0.75/user/year CapEx for the SBC. But with BLF/SCA/Simultaneous Ring, your efficiency could could drop significantly — reasonably down to 5,000 users — i.e., $4.50/user/year CapEx. That’s a 6x difference in cost per user — but still a great price for all the features an SBC provides.

The revenues from BLF/SCA/Simultaneous Ring are also great, but probably not proportional to the signaling load. Can you really charge 6x or 10x the price for a BLF/SCA/Simultaneous Ring customer? Of course not; but remember that the signaling load is not the only cost of the system. Technical talent, network transport, Customer Premise Equipment, sales and marketing etc., are all significant expenses that are largely unaffected by these features.

Not all SIP Phones are Created Equal

You’ve got to consider the Customer Premise Equipment selection. BLF/SCA are advanced new features, and do not enjoy the robust, mature, time-and-customer-tested support of ordinary call control. While Polycom has been supporting BLF/SCA for years and wide deployment, many other phones do not have the history. There’s nothing magical about Polycom — they just have a head start on software maturity and reliability. And they have the experience with SIP-over-TCP necessary to make BLF work well.

Finally, test scale before you deploy. Testing a three-member BLF/SCA group in the lab is not adequate preparation to sell a ten-member BLF/SCA group. Because of the non-linear growth in signaling, and the requirement to use SIP over TCP for reliable BLF/Line State updates, these features do not scale up in clean intuitive ways.

Further, you’ve got to test the transport. Very low levels of packet loss can seriously affect SIP over UDP deployments of Busy Lamp Field. Your Gigabit-Ethernet VoIP lab probably isn’t the best evaluate the reliability of your service, if that service is deployed using T1s to customers.

Before you deploy a big Simultaneous Ring / BLF / SCA group, you need to test and prove the reliability of that big group. You’ll be sorry if you don’t, and your customer will let you know just how sorry.

Proceed — with Caution.

Busy Lamp Field, Shared Call Appearance, Shared Line Appearance, and Simultaneous Ring are cool features, and well worth selling. But they constitute a genuine disruption to the ordinary Hosted IP PBX model that has been built with BroadWorks and Metaswitch for years. Network engineering, costs, and support all change in serious ways.

ECG has a new, high-speed training class on Acme Packet SIP Trunking and Registration. This is a high-speed class intended to cover just the basics you need to configure SIP trunking in the Acme Packet OS-C (4250, 4500, 3800, 9200), or configure SIP registration. ECG has been installing, configuring, and troubleshooting Acme Packet OS-C systems since 2004. We really know the box inside and out.

Let us show you the tactical details you need. Learn how to piece together a SIP Trunking or registration config — complete with realms, local-policy’s, sip-interface’s, steering-pool’s, session-group’s, session-agent’s, etc. Understand the key options, and learn which options to study later.

Read more on the Acme Packet Boot Camp: Building SIP Trunks & Registrationg page. You can email sales@e-c-group.com or call +1-229-244-2099.

ECG is rolling out new training courses. Another new class we have is on BroadWorks Call Processing and Troubleshooting.

This is a class for the people who really need to understand how BroadWorks does what it does. They need to know how to fix it when it breaks, and how to determine what’s broken.

This class covers all the arcane dark-magic BroadWorks tools, like healthmon, ttIsql, bwcli, and repctl, peercmd. We cover all the logs, like XSLogs, PSLogs, AuditLogs, and ms.syslog. We show you how the protocols interact.

This is a week-long class, taught at your location, or at ECG locations near Denver, Raleigh, or Valdosta, Georgia.

If you’re interested, read more on the BroadWorks Boot Camp: Call Processing & Troubleshooting page. You can email sales@e-c-group.com or call +1-229-244-2099.

We at ECG are pleased to announce a new training course: BroadWorks Installation and Upgrades.

This class is intended to give engineeers and technicians tons of experience installing, patching, and upgrading BroadWorks. There are a numerous small rules, and a few tricks. We at ECG have been doing Broadworks installations since R9 — back in 2002. We’ve done hundreds of installs for carriers around the world.

We have the scars. Let us save you some pain. In addition to being a crack team of special-forces consultants, ECG is a bona-fide BroadWorks service provider providing service in southern Georgia.

This is a week-long class, taught at your location, or at ECG locations near Denver, Raleigh, or Valdosta, Georgia.

If you’re interested, read more on the BroadWorks Boot Camp: Installation & Upgrades page. You can email sales@e-c-group.com or call +1-229-244-2099.