Kerberos: A real-time fraud detection system for IMS-enabled VoIP networks

- We present a real-time fraud detection system called Kerberos.
- Kerberos detects frauds in VoIP networks and achieves very good performance in terms of scalability.
- Kerberos leverages complex event processing techniques to achieve its design goals.
- Kerberos interoperates seamlessly with the On-line Charging System of a standard IMS network.
- Kerberos is a real-world engineering effort.
- Kerberos is being used on-field by Tiscali, a renown Italian operator.

In this paper we present the design, implementation and experimental evaluation of Kerberos, an architecture for the detection of frauds in current generation Voice over IP (VoIP) networks. Kerberos is fed by an On-line Charging System (OCS) generating events associated with the setup, evolution and tear-down of end-user calls in a VoIP network compliant with the IP Multimedia Subsystem (IMS) specification. Such events are properly correlated in order to identify, in real-time, patterns associated with a fraudulent utilization of the Operator's resources. The detection phase can in turn trigger the subsequent remediation actions. Communication between the OCS and Kerberos is based on an asynchronous paradigm, whereas event correlation and analysis are effectively realized through a Complex Event Processing approach. The paper will shed light on both the design and the implementation of the system, whose performance is then evaluated by relying on a real-world dataset of Call Detail Record (CDR) events provided by Tiscali, a well known Italian Operator.