Technical information

Detecting Toll Fraud
Issue 7 June 2001
4-55
ARS Measurement Selection
The ARS Measurement Selection feature can monitor up to 20 routing patterns
(25 for DEFINITY ECS and DEFINITY G3) for traffic flow and usage.
For DEFINITY ECS, DEFINITY G1, G3, and System 75:
 Enter change ars meas-selection to choose the routing patterns you want
to track.
 Enter list measurements route-pattern followed by the timeframe
(yesterday, today, or last-hour) to review the measurements.
Automatic Circuit Assurance (ACA)
This monitoring technique detects a pattern of short holding time calls or a single
long holding time call which may indicate hacker activity. Long holding times on
Trunk-to-Trunk calls can be a warning sign. The ACA feature allows you to
establish time limit thresholds defining what is considered a short holding time and
a long holding time. When a violation occurs, a designated station is notified. A
display message accompanies the referral call. If the switch is equipped with a
speech synthesis board, an audible message accompanies the call.
When a notification occurs, determine if the call is still active. If toll fraud is
suspected (for example, aca-short or aca-long is displayed on the designated
phone), use the busy verification feature (see ‘‘Busy Verification’’ on page 4-69) to
monitor the call in progress.
With Remote Access, when hacker activity is present, there is usually a burst of
short holding times as the hacker attempts to break the barrier code or
authorization code protection, or long holding time calls after the hacker is
successful. An ACA alarm on a Remote Access trunk should be considered a
potential threat and investigated immediately. If the call is answered by an
automated attendant, a hacker may be attempting to gain access to the system
facilities using TACs.
For DEFINITY ECS, DEFINITY G1, G3, and System 75:
 Enter change system-parameters feature to display the
Features-Related System Parameters screen.
 Enter y in the Automatic Circuit Assurance (ACA) Enabled field.
 Enter local, primary, or remote in the ACA Referral Calls field. If
primary is selected, calls can be received from other switches. Remote
applies if the PBX being administered is a DCS node, perhaps unattended,
that wants ACA referral calls to go to an extension or console at another
DCS node.
 Complete the following fields as well: ACA Referral Destination, ACA Short
Holding Time Originating Extension, ACA Long Holding Time Originating
Extension, and ACA Remote PBX Identification.