SMS Anti-Spam proactivity A

Study case
Ing. Gonzalo Escuder Bell
Core Network Manager
ANTEL
gdescuder@antel.com.uy

Content

Introduction: SMS SPAM concet !"es again#$

Tune%u !tec&nical$

SPAM sources

SPAM detection

Stoing SPAM

In%&ouse tool'o(: w&at we can do rig&t now#

SMS SPAM concet
)*unwanted te(t +essage recei,ed on a +o'ile de,ice-
(http://www.gsma.com/technicalprojects/gsma-spam-reporting-
services/sms-spam)
.e &a,e seen t&is 'e/ore* again and again o,er e,ol,ing
tec&nologies !e.g. +ail SPAM0 e+ail SPAM0 SMS SPAM*$.
T&ere are lot o/ lessons learned..
)Sa+ is an issue a'out consent0 not content.-
(http://www.spamhaus.org/consumer/definition/)

SMS SPAM concet !1$
But.. i/ t&ere2s a deli'erated wa" to 'e e(cluded
/ro+ a )SPAM- list0 it can2t 'e called SPAM
ANTEL: "ou can sto recei,ing custo+er
co++unications '" sending an SMS to a s&ort
code or calling custo+er care

Tune%u: SMS MT%deli,er"

SPAM sources !c&annels$

our Mo'ile custo+ers !SIM 'o(es$

our Partners !SMPP$

e(ternal sources !34$ 5 SMS%Cs o/ ot&er

carriers wit& roa+ing agree+ent

IMP67TANT:

roa+ing agree+ent 89 SMS interworking

SPAM detection
!not an eas" task$

B" sa+ engines

SPAM reorting ser,ice

Statistical anal"sis !later on$

Stoing SPAM
Acting o,er c&annels !a/ter detection o/ SPAM$

Blocking sources

our network

SIMs !/ine grain$

artners SMPP !w&ole tra//ic /ro+ t&is source$

e(ternal sources

GT 'locking !34$ !w&ole tra//ic /ro+ t&is source$

Stoing SPAM !1$

Acting on e,er" +essage

our network !SIMs0 SMPP$ : SMSC /iltering engine

e(ternal sources

SMS :;B agree+ent !win%win relation wit& :;B as

t&e" don2t &a,e to a" /or t&is ter+inated tra//ic$

;sing own SMSC /iltering engine !/orwarding

inco+ing +essages to /iltering engine$

In%&ouse tool'o( !)&ands%on-$: a
case o/ stud"
SIGT7AN tra//ic can 'e anal"sed '" wires&ark !signalling links$
Auto+ated tools can 'e de,eloed on to o/ t&is ),isi'ilit"-:
<etection:
statistical anal"sis !attern tra//ic$
content anal"sis !=,er"= co+le($
Blocking:
:L7 S7I 'locking
Signalling router GT 'locking
7eorting:
sa++ers can 'e reorted

Stud" case
ANTEL %9 +ost o/ t&e SPAM co+ing /ro+ outside networks !roa+ing artners$
.ires&ark cature o/ international links is 'eing real%ti+e anal"sed in order to detect
c&anging atterns.
Action is er/or+ed '" 'locking S7I on :L7
E//ecti,iness:
+ost o/ t&e SPAM was stoed
t&ere are )/alse%ositi,es- !can 'e re%oened later$
Co+li+entar" actions:
assing )dangerous- networks t&roug& :;B