1. Comprehensive
CDR Analysis Tool
CCAT
● Introduction
A call detail record (CDR) is a data record produced by a telephone exchange or other
telecommunications equipment that documents the details of a telephone call or other
communications transaction (e.g. text message) that passes through that facility or device.
The record contains various attributes of the call, such as time, duration, completion status,
source number, and destination number. There are two types of CDRs. One is normal CDR
and other is the GPRS CDR.
● Contents of CDR
Call Data Records contains the following information :
1. The phone number of the subscriber originating the call (calling party, A-party)
2. The phone number receiving the call (called party, B-party)
3. The SMS details (A party and B party)
4. Auto generated SMS (sent by companies)
5. Starting time of the call (Date and time)
6. Duration of the call
7. Billing phone number charged for the call
8. IMEI Number
9. IMSI Number
10.Call type (In/Out Call/SMS)
11.Cell Id used to determine the location
12.Type Of Connection (Prepaid/Postpaid)
13.Roaming Circle
14.2G/3G Indicator
Sample CDR
2. ● Requirements
1. CCAT is built on Python, so we need Python 2.7 or greater compiler to execute the
tool.
2. CCAT is Operating System Independent and so it can run on any Operating System
including Windows, Mac OS, Linux.
3. Microsoft Excel or any equivalent software which supports Visual Basic Macros
4. Libraries required in Python
a) openpyxl
b) Pycurl
c) JSON
5. Curl to be installed on the system
6. Google Earth
7. Xampp or Lamp server (Mysql,phpmyadmin)
8. Google Geolocation API key (Server key from Google)
9. Facebook API access key(User access token, client token, page access token)
● Open SourceIntelligence(OSINT)using CDR
3. CCAT is using Facebook crawler API using the Facebook graph API which is an open
source API available freely from Facebook for developers. It is made from a python script
which uses mysql to give an output of the search. It scrapes all the open source data
available on Facebook.
Information it gives -
1. Posts and Comments related to the person.
2. Location based information from the posts.
3. “Talking about ..” tags
4. Other useful information
CCAT uses a SQL database to stores the information - output from Facebook crawler for
future use in investigations for other crimes.
Gathering the Open Source Information available on Facebook Platform using our Facebook
Crawler tool .
The script is written in python and scrapes only the useful data from facebook platform
according to the user input of keywords. Additionally , it filters out posts based on Date and
Time of Creation of the Posts . This helps in analyzing how different people across the
platform are reacting upon particular searched matters in a given time frame.
At this point , the Facebook Crawler Script is capable of bringing the output in raw format and
we’re working on making it a full-fledged GUI Based tool in an advanced version with a lot
more functionalities .
● FacebookCrawler’s Sample Output(Based On Date & Time of
Creation of the Posts ):
4. FacebookCrawler Output listing Posts based on keyword Selection,
Date and Time of Creation .
● Google Geolocation API
CCAT uses the Google Geolocation Api to give a output - Latitude and Longitude taking input
as the Cell Id, Local Area Code(LAC), Mobile Network Code(MNC), Mobile Country
5. Code(MCC). It sends a JSON request to the google geolocation and gets coordinates with an
accuracy of around 800-900 metres which is basically the radius from the coordinates.
JSON file for finding the Latitude and Longitude
OUTPUT
7. CDR files from different service providers vary in terms of the data headings and formatting.
It is vital that the tool converts the given CDR into a standard format that CCAT can work on
and this conversion is realized with the help of a single Microsoft Excel Document with the
help of Visual Basic Macros and Excel VLookUp feature.
8. The user has to import the given CDR into Sheet1 of the Excel workbook and then select the
service provider of the CDR in Sheet2 to run the software. A reset button has also been
provided to clear the contents of the final output which is stored in Sheet 2 itself.
Note: The reset button will not reset the contents of Sheet1 ie the imported CDR. Incase of
any issues, please re-import the CDR sheet into Sheet1. Also not that you might be asked to
enable Macros when you open the Excel document. Please enable this feature to use this
converter.
The Visual Basic (VB) Macro scripts work automatically to import the BTS Address from the
corresponding databases of the service provider. This is helpful in determining the latitude
and longitude information of the record being analysed.
9. ● KML Generator
To derive some meaning from the acquired geo-location information, CCAT provides
the feature to convert the data to a KML file directly. Keyhole Markup Language (KML) is an
XML notation for expressing geographic annotation and visualization within Internet-based,
two-dimensional maps and three-dimensional Earth browsers. KML was developed for use
with Google Earth, which was originally named Keyhole Earth Viewer.
Users can run the KML Generator by firstly specifying the path for the output KML file
by entering the directory location as well as the desired name of the file in cell C2 of the
3_KML_Generator sheet. Optionally, you may provide the document a name as well.
10. Once done, simply click on the Generate KML File button to create the desired KML file.
● OutputOn Google Earth
After generating the KML files through a macro in the excel sheet, we use google
earth to plot the coordinates and get a path on it so we can trace the locations of the cell
phone for the duration we are having the CDR. It works on a very simple click and shows the
output in a easily readable format.
11. Google Earth
● CDR Analyzer Outputin ExcelSheet
CCAT gives the output of the CDR after analyzing it in an excel sheet. The excel sheet
has the following output -
1. IMEI Number
2. IMSI Number
3. First Call And Last Call for each day
4. Frequently Outgoing Calls
5. Frequently Incoming Calls
6. Frequently Outgoing SMS
7. Frequently Incoming SMS
8. Unique Outgoing Calls
9. Unique Incoming Calls
10.Unique Outgoing SMS
11.Unique Incoming SMS
12. Latitude And Longitude for each Call and SMS
12. ● Future Enhancements
1. Output in Graphic User Interface(GUI) - In a website page so Law Enforcement
agencies can find it more easy to use the tool. Currently we are having the output in
the excel sheet which is easily readable but not a good GUI for an output.
2. Database - We have an aim to make a database which correlates with previous CDRs
in the database and gives output on that basis. This will be using Artificial Intelligence
techniques for correlation of the CDRs and provide some output useful to Law
Enforcement Agencies.
3. Analytics along with Graph Generation - CCAT analyzes the CDRs with python scripts
but we also aim to analyze the CDRs using graph techniques and provide Graph
Analysis as well along with our normal analytics.
4. Adding Social Media crawlers - CCAT uses only Facebook Crawler now but we also
aim to integrate other Social Medias like Instagram, Twitter, LinkedIn and others.
5. Auto Generation Of Latitude and Longitudes for all Cell Ids and store it in the excel
output. Currently we are having it manually as we need to put Cell Id, Local Area
Code(LAC), Mobile Network Code(MNC), Mobile Country Code(MCC) in the JSON file
and run the Curl command in the terminal and get the output there itself and then put
the latitude and longitude in the excel output sheet manually.
6. Tower Dump Analysis - We also aim at adding the tower dump analysis to our
software which can give us the exact location of the cell phone.
● Resources
1. https://developers.google.com/maps/documentation/geolocation/intro
2. https://developers.facebook.com/docs/sharing/webmasters/crawler
3. https://automatetheboringstuff.com/chapter12/
4. https://developers.facebook.com/docs/graph-api
