SlideShare a Scribd company logo
Telco Fraud Detection and
Mitigation
Cu D. Nguyen, Ph.D.
Data Scientist and Security Architect
POST Luxembourg
November 2018
POST Luxembourg
Telecom
Services,
Infrastructures
& ICT
Postal/Courrier
& Logistique
Financial
Services
4371
employees
43
nationalities
My Background and Role
▶ Data Scientist and Security Architect at Post
Luxembourg
▶ Machine learning, computer security, software
engineering
▶ Security blue team:
▶ Visibility, Intelligence, and Action
▶ Innovation
▶ “Splunk> see the forest, and the trees”
Cu D. Nguyen, Ph.D.
Telco fraud – a multi-million-dollar-a-year problem
PBX hacking
▶ A telephone system within an enterprise
▶ Switching calls among local users and
share external phone lines
What is a PBX?
And when it’s hacked, what happens?
▶ Attackers/fraudsters control the PBX,
making premium rate (expensive) calls
A deep-dive into a PBX hacking fraud
Hacked phone numbers
Premium phone numbers
owned by fraudsters
A deep-dive into a PBX hacking fraud
A well-organized crime:
• 19 calling numbers from the
hacked PBX
• 1000+ destination numbers all
over the world
• Cost ~50K euros if not handled
What we’ve learned
Fraudsters are well-organized and evolving
Running AFTER them, we need to be FAST and PRECISE!
BigData
Analytics
Machine
Learning
Automation
Comprehensive Quality & Governance
▶ Filtering
▶ Anonymizing
▶ Parsing
▶ Enriching
▶ Role-based access
control
▶ Auditability
Extendibility and
Scalability
▶ Scalable in a linear
fashion
▶ Apps & TAs
Why Splunk?
hours
weeks
Splunk at Post Luxembourg
Spam/Fraud
detectors
Voice
Mobile & Fix
SMS/MMS
Block/unblock API
On Telecom Gateways
Network
CDRs
Machine learning
IT DDoS
TIDS DevOps
• 62.5M events/day
• Approx. filtered
80GB/day
Fraud management GUI
Fraud detection using machine learning
 Use historical data
for training models
(detectors)
 Use the trained
models for
classifying new data
 Frequent retraining
to catch new
patterns
Image source: http://www.cognub.com/index.php/cognitive-platform/
Fraud detection using Splunk ML Toolkit
normal cases
frauds
Features: number of calls, number of targets, destination countries, cost, duration ….
Models: Random Forest (+ statistical models)
Encouraging results
Hacked numbers being
detected and blocked
automatically
What’s next?
▶ Evolving telco frauds meet evolving solutions
▶ Faster
▶ Broader, covering more cases
▶ Smarter, being more precise and dealing with new patterns
▶ Machine learning
▶ From supervised to semi or unsupervised, in collaboration with University of Luxembourg
▶ AutoML (algorithm selection and hyperparameter tuning)
© 2018 SPLUNK INC.
Key
Takeaways

More Related Content

What's hot

Partner Exec Summit 2018 - Frankfurt: Partner Brauchen Wir Nicht
Partner Exec Summit 2018 - Frankfurt: Partner Brauchen Wir NichtPartner Exec Summit 2018 - Frankfurt: Partner Brauchen Wir Nicht
Partner Exec Summit 2018 - Frankfurt: Partner Brauchen Wir Nicht
Splunk
 
SplunkLIve! Warsaw IoT Session
SplunkLIve! Warsaw IoT SessionSplunkLIve! Warsaw IoT Session
SplunkLIve! Warsaw IoT Session
Splunk
 
Splunk for ITOA Breakout Session
Splunk for ITOA Breakout SessionSplunk for ITOA Breakout Session
Splunk for ITOA Breakout Session
Splunk
 
Splunk IT Service Intelligence Overview - AIOps Roundtable Bern
Splunk IT Service Intelligence Overview - AIOps Roundtable BernSplunk IT Service Intelligence Overview - AIOps Roundtable Bern
Splunk IT Service Intelligence Overview - AIOps Roundtable Bern
Splunk
 
Splunk Internet of Things Roundtable 2015
Splunk Internet of Things Roundtable 2015Splunk Internet of Things Roundtable 2015
Splunk Internet of Things Roundtable 2015
Georg Knon
 
Managing SCADA Operations and Security with Splunk Enterprise
Managing SCADA Operations and Security with Splunk EnterpriseManaging SCADA Operations and Security with Splunk Enterprise
Managing SCADA Operations and Security with Splunk Enterprise
Splunk
 
Managing SCADA Operations and Security with Splunk Enterprise
Managing SCADA Operations and Security with Splunk EnterpriseManaging SCADA Operations and Security with Splunk Enterprise
Managing SCADA Operations and Security with Splunk Enterprise
Splunk
 
Splunk for Industrial Data and the Internet of Things
Splunk for Industrial Data and the Internet of ThingsSplunk for Industrial Data and the Internet of Things
Splunk for Industrial Data and the Internet of Things
aliciasyc
 
Splunk for ITOA Breakout Session
Splunk for ITOA Breakout SessionSplunk for ITOA Breakout Session
Splunk for ITOA Breakout Session
Splunk
 
Splunk for ITOA Breakout Session
Splunk for ITOA Breakout SessionSplunk for ITOA Breakout Session
Splunk for ITOA Breakout Session
Splunk
 
Splunk Discovery: Milan 2018 - Delivering New Visibility and Analytics for IT...
Splunk Discovery: Milan 2018 - Delivering New Visibility and Analytics for IT...Splunk Discovery: Milan 2018 - Delivering New Visibility and Analytics for IT...
Splunk Discovery: Milan 2018 - Delivering New Visibility and Analytics for IT...
Splunk
 
Protect & Defend Your Critical Infrastructure
Protect & Defend Your Critical InfrastructureProtect & Defend Your Critical Infrastructure
Protect & Defend Your Critical Infrastructure
Q1 Labs
 
Partner Exec Summit 2018 - Frankfurt: Splunk Business Flow Beta
Partner Exec Summit 2018 - Frankfurt: Splunk Business Flow BetaPartner Exec Summit 2018 - Frankfurt: Splunk Business Flow Beta
Partner Exec Summit 2018 - Frankfurt: Splunk Business Flow Beta
Splunk
 
Cisco Connect 2018 Indonesia - Delivering intent for data center networking
Cisco Connect 2018 Indonesia - Delivering intent for data center networking Cisco Connect 2018 Indonesia - Delivering intent for data center networking
Cisco Connect 2018 Indonesia - Delivering intent for data center networking
NetworkCollaborators
 
SplunkLive! Customer Presentation - ExxonMobil
SplunkLive! Customer Presentation - ExxonMobilSplunkLive! Customer Presentation - ExxonMobil
SplunkLive! Customer Presentation - ExxonMobil
Splunk
 
SplunkLive! Customer Presentation – Cox Automotive
SplunkLive! Customer Presentation – Cox AutomotiveSplunkLive! Customer Presentation – Cox Automotive
SplunkLive! Customer Presentation – Cox Automotive
Splunk
 
Splunk for Monitoring and Diagnostics in the Industrial Environment
Splunk for Monitoring and Diagnostics in the Industrial Environment Splunk for Monitoring and Diagnostics in the Industrial Environment
Splunk for Monitoring and Diagnostics in the Industrial Environment
Splunk
 
Cisco Connect 2018 Indonesia - Building a secure data center
Cisco Connect 2018 Indonesia - Building a secure data center Cisco Connect 2018 Indonesia - Building a secure data center
Cisco Connect 2018 Indonesia - Building a secure data center
NetworkCollaborators
 
Sharon’ Besser, Net Optics VP of Technology, Net Optics, discusses Lawful Int...
Sharon’ Besser, Net Optics VP of Technology, Net Optics, discusses Lawful Int...Sharon’ Besser, Net Optics VP of Technology, Net Optics, discusses Lawful Int...
Sharon’ Besser, Net Optics VP of Technology, Net Optics, discusses Lawful Int...
LiveAction Next Generation Network Management Software
 
IoT Security
IoT SecurityIoT Security
IoT Security
Peter Waher
 

What's hot (20)

Partner Exec Summit 2018 - Frankfurt: Partner Brauchen Wir Nicht
Partner Exec Summit 2018 - Frankfurt: Partner Brauchen Wir NichtPartner Exec Summit 2018 - Frankfurt: Partner Brauchen Wir Nicht
Partner Exec Summit 2018 - Frankfurt: Partner Brauchen Wir Nicht
 
SplunkLIve! Warsaw IoT Session
SplunkLIve! Warsaw IoT SessionSplunkLIve! Warsaw IoT Session
SplunkLIve! Warsaw IoT Session
 
Splunk for ITOA Breakout Session
Splunk for ITOA Breakout SessionSplunk for ITOA Breakout Session
Splunk for ITOA Breakout Session
 
Splunk IT Service Intelligence Overview - AIOps Roundtable Bern
Splunk IT Service Intelligence Overview - AIOps Roundtable BernSplunk IT Service Intelligence Overview - AIOps Roundtable Bern
Splunk IT Service Intelligence Overview - AIOps Roundtable Bern
 
Splunk Internet of Things Roundtable 2015
Splunk Internet of Things Roundtable 2015Splunk Internet of Things Roundtable 2015
Splunk Internet of Things Roundtable 2015
 
Managing SCADA Operations and Security with Splunk Enterprise
Managing SCADA Operations and Security with Splunk EnterpriseManaging SCADA Operations and Security with Splunk Enterprise
Managing SCADA Operations and Security with Splunk Enterprise
 
Managing SCADA Operations and Security with Splunk Enterprise
Managing SCADA Operations and Security with Splunk EnterpriseManaging SCADA Operations and Security with Splunk Enterprise
Managing SCADA Operations and Security with Splunk Enterprise
 
Splunk for Industrial Data and the Internet of Things
Splunk for Industrial Data and the Internet of ThingsSplunk for Industrial Data and the Internet of Things
Splunk for Industrial Data and the Internet of Things
 
Splunk for ITOA Breakout Session
Splunk for ITOA Breakout SessionSplunk for ITOA Breakout Session
Splunk for ITOA Breakout Session
 
Splunk for ITOA Breakout Session
Splunk for ITOA Breakout SessionSplunk for ITOA Breakout Session
Splunk for ITOA Breakout Session
 
Splunk Discovery: Milan 2018 - Delivering New Visibility and Analytics for IT...
Splunk Discovery: Milan 2018 - Delivering New Visibility and Analytics for IT...Splunk Discovery: Milan 2018 - Delivering New Visibility and Analytics for IT...
Splunk Discovery: Milan 2018 - Delivering New Visibility and Analytics for IT...
 
Protect & Defend Your Critical Infrastructure
Protect & Defend Your Critical InfrastructureProtect & Defend Your Critical Infrastructure
Protect & Defend Your Critical Infrastructure
 
Partner Exec Summit 2018 - Frankfurt: Splunk Business Flow Beta
Partner Exec Summit 2018 - Frankfurt: Splunk Business Flow BetaPartner Exec Summit 2018 - Frankfurt: Splunk Business Flow Beta
Partner Exec Summit 2018 - Frankfurt: Splunk Business Flow Beta
 
Cisco Connect 2018 Indonesia - Delivering intent for data center networking
Cisco Connect 2018 Indonesia - Delivering intent for data center networking Cisco Connect 2018 Indonesia - Delivering intent for data center networking
Cisco Connect 2018 Indonesia - Delivering intent for data center networking
 
SplunkLive! Customer Presentation - ExxonMobil
SplunkLive! Customer Presentation - ExxonMobilSplunkLive! Customer Presentation - ExxonMobil
SplunkLive! Customer Presentation - ExxonMobil
 
SplunkLive! Customer Presentation – Cox Automotive
SplunkLive! Customer Presentation – Cox AutomotiveSplunkLive! Customer Presentation – Cox Automotive
SplunkLive! Customer Presentation – Cox Automotive
 
Splunk for Monitoring and Diagnostics in the Industrial Environment
Splunk for Monitoring and Diagnostics in the Industrial Environment Splunk for Monitoring and Diagnostics in the Industrial Environment
Splunk for Monitoring and Diagnostics in the Industrial Environment
 
Cisco Connect 2018 Indonesia - Building a secure data center
Cisco Connect 2018 Indonesia - Building a secure data center Cisco Connect 2018 Indonesia - Building a secure data center
Cisco Connect 2018 Indonesia - Building a secure data center
 
Sharon’ Besser, Net Optics VP of Technology, Net Optics, discusses Lawful Int...
Sharon’ Besser, Net Optics VP of Technology, Net Optics, discusses Lawful Int...Sharon’ Besser, Net Optics VP of Technology, Net Optics, discusses Lawful Int...
Sharon’ Besser, Net Optics VP of Technology, Net Optics, discusses Lawful Int...
 
IoT Security
IoT SecurityIoT Security
IoT Security
 

Similar to SplunkLive! Utrecht 2018 - Customer presentation: POST Luxembourg

Lessons Learned Fighting Modern Cyberthreats in Critical ICS Networks
Lessons Learned Fighting Modern Cyberthreats in Critical ICS NetworksLessons Learned Fighting Modern Cyberthreats in Critical ICS Networks
Lessons Learned Fighting Modern Cyberthreats in Critical ICS Networks
Angeloluca Barba
 
Lessons v on fraud awareness (digital forensics)
Lessons v on fraud awareness   (digital forensics)Lessons v on fraud awareness   (digital forensics)
Lessons v on fraud awareness (digital forensics)
CA.Kolluru Narayanarao
 
Lessons v on fraud awareness (digital forensics) [autosaved]
Lessons v on fraud awareness   (digital forensics) [autosaved]Lessons v on fraud awareness   (digital forensics) [autosaved]
Lessons v on fraud awareness (digital forensics) [autosaved]
Kolluru N Rao
 
Apostu sergiu project
Apostu sergiu projectApostu sergiu project
Apostu sergiu project
Apostu Sergiu
 
Data mining in telecommunication industry
Data mining in telecommunication industryData mining in telecommunication industry
Data mining in telecommunication industry
harshu966
 
IT Network Security Services
IT Network Security ServicesIT Network Security Services
IT Network Security Services
martinvoelk
 
World of Signals - Devices - Connectivity - Signals - RF - Cyber Security.
World of Signals - Devices - Connectivity - Signals - RF - Cyber Security.World of Signals - Devices - Connectivity - Signals - RF - Cyber Security.
World of Signals - Devices - Connectivity - Signals - RF - Cyber Security.
Jan Geirnaert
 
Uganda lawsociety v2digitalforensics
Uganda lawsociety v2digitalforensicsUganda lawsociety v2digitalforensics
Uganda lawsociety v2digitalforensics
Mustapha Mugisa
 
Securty Issues from 1999
Securty Issues from 1999Securty Issues from 1999
Securty Issues from 1999
TomParker
 
Digital Forensics Training Bootcamp (Systems Engineering ) Part - Tonex Training
Digital Forensics Training Bootcamp (Systems Engineering ) Part - Tonex TrainingDigital Forensics Training Bootcamp (Systems Engineering ) Part - Tonex Training
Digital Forensics Training Bootcamp (Systems Engineering ) Part - Tonex Training
Bryan Len
 
Brochure of ICSS
Brochure of ICSS Brochure of ICSS
Tecomex Forensics Brochure 2014
Tecomex Forensics Brochure 2014Tecomex Forensics Brochure 2014
Tecomex Forensics Brochure 2014
Dr. Idris Ahmed
 
Sect r35 b
Sect r35 bSect r35 b
Voice communication security
Voice communication securityVoice communication security
Voice communication security
Fabio Pietrosanti
 
iPads on your network? Take Control with Unified Policy and Management
iPads on your network? Take Control with Unified Policy and ManagementiPads on your network? Take Control with Unified Policy and Management
iPads on your network? Take Control with Unified Policy and Management
Cisco Mobility
 
AI in the Enterprise: Past, Present & Future - StampedeCon AI Summit 2017
AI in the Enterprise: Past,  Present &  Future - StampedeCon AI Summit 2017AI in the Enterprise: Past,  Present &  Future - StampedeCon AI Summit 2017
AI in the Enterprise: Past, Present & Future - StampedeCon AI Summit 2017
StampedeCon
 
Cyber innovation without a new product to buy-Michael Boeckx - cybersec europ...
Cyber innovation without a new product to buy-Michael Boeckx - cybersec europ...Cyber innovation without a new product to buy-Michael Boeckx - cybersec europ...
Cyber innovation without a new product to buy-Michael Boeckx - cybersec europ...
NRBsanv
 
Machine Learning and Knowledge Representation: a Synergic Approach for Busine...
Machine Learning and Knowledge Representation: a Synergic Approach for Busine...Machine Learning and Knowledge Representation: a Synergic Approach for Busine...
Machine Learning and Knowledge Representation: a Synergic Approach for Busine...
Data Driven Innovation
 
Core Values Decision Sept
Core Values Decision SeptCore Values Decision Sept
Core Values Decision Sept
Computer_Forensic
 
Securing Your Intellectual Property: Preventing Business IP Leaks
Securing Your Intellectual Property: Preventing Business IP LeaksSecuring Your Intellectual Property: Preventing Business IP Leaks
Securing Your Intellectual Property: Preventing Business IP Leaks
Hokme
 

Similar to SplunkLive! Utrecht 2018 - Customer presentation: POST Luxembourg (20)

Lessons Learned Fighting Modern Cyberthreats in Critical ICS Networks
Lessons Learned Fighting Modern Cyberthreats in Critical ICS NetworksLessons Learned Fighting Modern Cyberthreats in Critical ICS Networks
Lessons Learned Fighting Modern Cyberthreats in Critical ICS Networks
 
Lessons v on fraud awareness (digital forensics)
Lessons v on fraud awareness   (digital forensics)Lessons v on fraud awareness   (digital forensics)
Lessons v on fraud awareness (digital forensics)
 
Lessons v on fraud awareness (digital forensics) [autosaved]
Lessons v on fraud awareness   (digital forensics) [autosaved]Lessons v on fraud awareness   (digital forensics) [autosaved]
Lessons v on fraud awareness (digital forensics) [autosaved]
 
Apostu sergiu project
Apostu sergiu projectApostu sergiu project
Apostu sergiu project
 
Data mining in telecommunication industry
Data mining in telecommunication industryData mining in telecommunication industry
Data mining in telecommunication industry
 
IT Network Security Services
IT Network Security ServicesIT Network Security Services
IT Network Security Services
 
World of Signals - Devices - Connectivity - Signals - RF - Cyber Security.
World of Signals - Devices - Connectivity - Signals - RF - Cyber Security.World of Signals - Devices - Connectivity - Signals - RF - Cyber Security.
World of Signals - Devices - Connectivity - Signals - RF - Cyber Security.
 
Uganda lawsociety v2digitalforensics
Uganda lawsociety v2digitalforensicsUganda lawsociety v2digitalforensics
Uganda lawsociety v2digitalforensics
 
Securty Issues from 1999
Securty Issues from 1999Securty Issues from 1999
Securty Issues from 1999
 
Digital Forensics Training Bootcamp (Systems Engineering ) Part - Tonex Training
Digital Forensics Training Bootcamp (Systems Engineering ) Part - Tonex TrainingDigital Forensics Training Bootcamp (Systems Engineering ) Part - Tonex Training
Digital Forensics Training Bootcamp (Systems Engineering ) Part - Tonex Training
 
Brochure of ICSS
Brochure of ICSS Brochure of ICSS
Brochure of ICSS
 
Tecomex Forensics Brochure 2014
Tecomex Forensics Brochure 2014Tecomex Forensics Brochure 2014
Tecomex Forensics Brochure 2014
 
Sect r35 b
Sect r35 bSect r35 b
Sect r35 b
 
Voice communication security
Voice communication securityVoice communication security
Voice communication security
 
iPads on your network? Take Control with Unified Policy and Management
iPads on your network? Take Control with Unified Policy and ManagementiPads on your network? Take Control with Unified Policy and Management
iPads on your network? Take Control with Unified Policy and Management
 
AI in the Enterprise: Past, Present & Future - StampedeCon AI Summit 2017
AI in the Enterprise: Past,  Present &  Future - StampedeCon AI Summit 2017AI in the Enterprise: Past,  Present &  Future - StampedeCon AI Summit 2017
AI in the Enterprise: Past, Present & Future - StampedeCon AI Summit 2017
 
Cyber innovation without a new product to buy-Michael Boeckx - cybersec europ...
Cyber innovation without a new product to buy-Michael Boeckx - cybersec europ...Cyber innovation without a new product to buy-Michael Boeckx - cybersec europ...
Cyber innovation without a new product to buy-Michael Boeckx - cybersec europ...
 
Machine Learning and Knowledge Representation: a Synergic Approach for Busine...
Machine Learning and Knowledge Representation: a Synergic Approach for Busine...Machine Learning and Knowledge Representation: a Synergic Approach for Busine...
Machine Learning and Knowledge Representation: a Synergic Approach for Busine...
 
Core Values Decision Sept
Core Values Decision SeptCore Values Decision Sept
Core Values Decision Sept
 
Securing Your Intellectual Property: Preventing Business IP Leaks
Securing Your Intellectual Property: Preventing Business IP LeaksSecuring Your Intellectual Property: Preventing Business IP Leaks
Securing Your Intellectual Property: Preventing Business IP Leaks
 

More from Splunk

.conf Go 2023 - Data analysis as a routine
.conf Go 2023 - Data analysis as a routine.conf Go 2023 - Data analysis as a routine
.conf Go 2023 - Data analysis as a routine
Splunk
 
.conf Go 2023 - How KPN drives Customer Satisfaction on IPTV
.conf Go 2023 - How KPN drives Customer Satisfaction on IPTV.conf Go 2023 - How KPN drives Customer Satisfaction on IPTV
.conf Go 2023 - How KPN drives Customer Satisfaction on IPTV
Splunk
 
.conf Go 2023 - Navegando la normativa SOX (Telefónica)
.conf Go 2023 - Navegando la normativa SOX (Telefónica).conf Go 2023 - Navegando la normativa SOX (Telefónica)
.conf Go 2023 - Navegando la normativa SOX (Telefónica)
Splunk
 
.conf Go 2023 - Raiffeisen Bank International
.conf Go 2023 - Raiffeisen Bank International.conf Go 2023 - Raiffeisen Bank International
.conf Go 2023 - Raiffeisen Bank International
Splunk
 
.conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett
.conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett .conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett
.conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett
Splunk
 
.conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär)
.conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär).conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär)
.conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär)
Splunk
 
.conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu...
.conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu....conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu...
.conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu...
Splunk
 
.conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever...
.conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever....conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever...
.conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever...
Splunk
 
.conf go 2023 - De NOC a CSIRT (Cellnex)
.conf go 2023 - De NOC a CSIRT (Cellnex).conf go 2023 - De NOC a CSIRT (Cellnex)
.conf go 2023 - De NOC a CSIRT (Cellnex)
Splunk
 
conf go 2023 - El camino hacia la ciberseguridad (ABANCA)
conf go 2023 - El camino hacia la ciberseguridad (ABANCA)conf go 2023 - El camino hacia la ciberseguridad (ABANCA)
conf go 2023 - El camino hacia la ciberseguridad (ABANCA)
Splunk
 
Splunk - BMW connects business and IT with data driven operations SRE and O11y
Splunk - BMW connects business and IT with data driven operations SRE and O11ySplunk - BMW connects business and IT with data driven operations SRE and O11y
Splunk - BMW connects business and IT with data driven operations SRE and O11y
Splunk
 
Splunk x Freenet - .conf Go Köln
Splunk x Freenet - .conf Go KölnSplunk x Freenet - .conf Go Köln
Splunk x Freenet - .conf Go Köln
Splunk
 
Splunk Security Session - .conf Go Köln
Splunk Security Session - .conf Go KölnSplunk Security Session - .conf Go Köln
Splunk Security Session - .conf Go Köln
Splunk
 
Data foundations building success, at city scale – Imperial College London
 Data foundations building success, at city scale – Imperial College London Data foundations building success, at city scale – Imperial College London
Data foundations building success, at city scale – Imperial College London
Splunk
 
Splunk: How Vodafone established Operational Analytics in a Hybrid Environmen...
Splunk: How Vodafone established Operational Analytics in a Hybrid Environmen...Splunk: How Vodafone established Operational Analytics in a Hybrid Environmen...
Splunk: How Vodafone established Operational Analytics in a Hybrid Environmen...
Splunk
 
SOC, Amore Mio! | Security Webinar
SOC, Amore Mio! | Security WebinarSOC, Amore Mio! | Security Webinar
SOC, Amore Mio! | Security Webinar
Splunk
 
.conf Go 2022 - Observability Session
.conf Go 2022 - Observability Session.conf Go 2022 - Observability Session
.conf Go 2022 - Observability Session
Splunk
 
.conf Go Zurich 2022 - Keynote
.conf Go Zurich 2022 - Keynote.conf Go Zurich 2022 - Keynote
.conf Go Zurich 2022 - Keynote
Splunk
 
.conf Go Zurich 2022 - Platform Session
.conf Go Zurich 2022 - Platform Session.conf Go Zurich 2022 - Platform Session
.conf Go Zurich 2022 - Platform Session
Splunk
 
.conf Go Zurich 2022 - Security Session
.conf Go Zurich 2022 - Security Session.conf Go Zurich 2022 - Security Session
.conf Go Zurich 2022 - Security Session
Splunk
 

More from Splunk (20)

.conf Go 2023 - Data analysis as a routine
.conf Go 2023 - Data analysis as a routine.conf Go 2023 - Data analysis as a routine
.conf Go 2023 - Data analysis as a routine
 
.conf Go 2023 - How KPN drives Customer Satisfaction on IPTV
.conf Go 2023 - How KPN drives Customer Satisfaction on IPTV.conf Go 2023 - How KPN drives Customer Satisfaction on IPTV
.conf Go 2023 - How KPN drives Customer Satisfaction on IPTV
 
.conf Go 2023 - Navegando la normativa SOX (Telefónica)
.conf Go 2023 - Navegando la normativa SOX (Telefónica).conf Go 2023 - Navegando la normativa SOX (Telefónica)
.conf Go 2023 - Navegando la normativa SOX (Telefónica)
 
.conf Go 2023 - Raiffeisen Bank International
.conf Go 2023 - Raiffeisen Bank International.conf Go 2023 - Raiffeisen Bank International
.conf Go 2023 - Raiffeisen Bank International
 
.conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett
.conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett .conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett
.conf Go 2023 - På liv og død Om sikkerhetsarbeid i Norsk helsenett
 
.conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär)
.conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär).conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär)
.conf Go 2023 - Many roads lead to Rome - this was our journey (Julius Bär)
 
.conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu...
.conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu....conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu...
.conf Go 2023 - Das passende Rezept für die digitale (Security) Revolution zu...
 
.conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever...
.conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever....conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever...
.conf go 2023 - Cyber Resilienz – Herausforderungen und Ansatz für Energiever...
 
.conf go 2023 - De NOC a CSIRT (Cellnex)
.conf go 2023 - De NOC a CSIRT (Cellnex).conf go 2023 - De NOC a CSIRT (Cellnex)
.conf go 2023 - De NOC a CSIRT (Cellnex)
 
conf go 2023 - El camino hacia la ciberseguridad (ABANCA)
conf go 2023 - El camino hacia la ciberseguridad (ABANCA)conf go 2023 - El camino hacia la ciberseguridad (ABANCA)
conf go 2023 - El camino hacia la ciberseguridad (ABANCA)
 
Splunk - BMW connects business and IT with data driven operations SRE and O11y
Splunk - BMW connects business and IT with data driven operations SRE and O11ySplunk - BMW connects business and IT with data driven operations SRE and O11y
Splunk - BMW connects business and IT with data driven operations SRE and O11y
 
Splunk x Freenet - .conf Go Köln
Splunk x Freenet - .conf Go KölnSplunk x Freenet - .conf Go Köln
Splunk x Freenet - .conf Go Köln
 
Splunk Security Session - .conf Go Köln
Splunk Security Session - .conf Go KölnSplunk Security Session - .conf Go Köln
Splunk Security Session - .conf Go Köln
 
Data foundations building success, at city scale – Imperial College London
 Data foundations building success, at city scale – Imperial College London Data foundations building success, at city scale – Imperial College London
Data foundations building success, at city scale – Imperial College London
 
Splunk: How Vodafone established Operational Analytics in a Hybrid Environmen...
Splunk: How Vodafone established Operational Analytics in a Hybrid Environmen...Splunk: How Vodafone established Operational Analytics in a Hybrid Environmen...
Splunk: How Vodafone established Operational Analytics in a Hybrid Environmen...
 
SOC, Amore Mio! | Security Webinar
SOC, Amore Mio! | Security WebinarSOC, Amore Mio! | Security Webinar
SOC, Amore Mio! | Security Webinar
 
.conf Go 2022 - Observability Session
.conf Go 2022 - Observability Session.conf Go 2022 - Observability Session
.conf Go 2022 - Observability Session
 
.conf Go Zurich 2022 - Keynote
.conf Go Zurich 2022 - Keynote.conf Go Zurich 2022 - Keynote
.conf Go Zurich 2022 - Keynote
 
.conf Go Zurich 2022 - Platform Session
.conf Go Zurich 2022 - Platform Session.conf Go Zurich 2022 - Platform Session
.conf Go Zurich 2022 - Platform Session
 
.conf Go Zurich 2022 - Security Session
.conf Go Zurich 2022 - Security Session.conf Go Zurich 2022 - Security Session
.conf Go Zurich 2022 - Security Session
 

Recently uploaded

Best 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERPBest 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERP
Pixlogix Infotech
 
GraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracyGraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracy
Tomaz Bratanic
 
Driving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success StoryDriving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success Story
Safe Software
 
Skybuffer AI: Advanced Conversational and Generative AI Solution on SAP Busin...
Skybuffer AI: Advanced Conversational and Generative AI Solution on SAP Busin...Skybuffer AI: Advanced Conversational and Generative AI Solution on SAP Busin...
Skybuffer AI: Advanced Conversational and Generative AI Solution on SAP Busin...
Tatiana Kojar
 
Operating System Used by Users in day-to-day life.pptx
Operating System Used by Users in day-to-day life.pptxOperating System Used by Users in day-to-day life.pptx
Operating System Used by Users in day-to-day life.pptx
Pravash Chandra Das
 
Generating privacy-protected synthetic data using Secludy and Milvus
Generating privacy-protected synthetic data using Secludy and MilvusGenerating privacy-protected synthetic data using Secludy and Milvus
Generating privacy-protected synthetic data using Secludy and Milvus
Zilliz
 
Azure API Management to expose backend services securely
Azure API Management to expose backend services securelyAzure API Management to expose backend services securely
Azure API Management to expose backend services securely
Dinusha Kumarasiri
 
Artificial Intelligence for XMLDevelopment
Artificial Intelligence for XMLDevelopmentArtificial Intelligence for XMLDevelopment
Artificial Intelligence for XMLDevelopment
Octavian Nadolu
 
Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)
Jakub Marek
 
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
Your One-Stop Shop for Python Success: Top 10 US Python Development ProvidersYour One-Stop Shop for Python Success: Top 10 US Python Development Providers
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
akankshawande
 
June Patch Tuesday
June Patch TuesdayJune Patch Tuesday
June Patch Tuesday
Ivanti
 
Finale of the Year: Apply for Next One!
Finale of the Year: Apply for Next One!Finale of the Year: Apply for Next One!
Finale of the Year: Apply for Next One!
GDSC PJATK
 
Trusted Execution Environment for Decentralized Process Mining
Trusted Execution Environment for Decentralized Process MiningTrusted Execution Environment for Decentralized Process Mining
Trusted Execution Environment for Decentralized Process Mining
LucaBarbaro3
 
Letter and Document Automation for Bonterra Impact Management (fka Social Sol...
Letter and Document Automation for Bonterra Impact Management (fka Social Sol...Letter and Document Automation for Bonterra Impact Management (fka Social Sol...
Letter and Document Automation for Bonterra Impact Management (fka Social Sol...
Jeffrey Haguewood
 
Deep Dive: Getting Funded with Jason Jason Lemkin Founder & CEO @ SaaStr
Deep Dive: Getting Funded with Jason Jason Lemkin Founder & CEO @ SaaStrDeep Dive: Getting Funded with Jason Jason Lemkin Founder & CEO @ SaaStr
Deep Dive: Getting Funded with Jason Jason Lemkin Founder & CEO @ SaaStr
saastr
 
Building Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and MilvusBuilding Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and Milvus
Zilliz
 
dbms calicut university B. sc Cs 4th sem.pdf
dbms  calicut university B. sc Cs 4th sem.pdfdbms  calicut university B. sc Cs 4th sem.pdf
dbms calicut university B. sc Cs 4th sem.pdf
Shinana2
 
Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...
Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...
Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...
saastr
 
AWS Cloud Cost Optimization Presentation.pptx
AWS Cloud Cost Optimization Presentation.pptxAWS Cloud Cost Optimization Presentation.pptx
AWS Cloud Cost Optimization Presentation.pptx
HarisZaheer8
 
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAUHCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
panagenda
 

Recently uploaded (20)

Best 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERPBest 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERP
 
GraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracyGraphRAG for Life Science to increase LLM accuracy
GraphRAG for Life Science to increase LLM accuracy
 
Driving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success StoryDriving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success Story
 
Skybuffer AI: Advanced Conversational and Generative AI Solution on SAP Busin...
Skybuffer AI: Advanced Conversational and Generative AI Solution on SAP Busin...Skybuffer AI: Advanced Conversational and Generative AI Solution on SAP Busin...
Skybuffer AI: Advanced Conversational and Generative AI Solution on SAP Busin...
 
Operating System Used by Users in day-to-day life.pptx
Operating System Used by Users in day-to-day life.pptxOperating System Used by Users in day-to-day life.pptx
Operating System Used by Users in day-to-day life.pptx
 
Generating privacy-protected synthetic data using Secludy and Milvus
Generating privacy-protected synthetic data using Secludy and MilvusGenerating privacy-protected synthetic data using Secludy and Milvus
Generating privacy-protected synthetic data using Secludy and Milvus
 
Azure API Management to expose backend services securely
Azure API Management to expose backend services securelyAzure API Management to expose backend services securely
Azure API Management to expose backend services securely
 
Artificial Intelligence for XMLDevelopment
Artificial Intelligence for XMLDevelopmentArtificial Intelligence for XMLDevelopment
Artificial Intelligence for XMLDevelopment
 
Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)Main news related to the CCS TSI 2023 (2023/1695)
Main news related to the CCS TSI 2023 (2023/1695)
 
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
Your One-Stop Shop for Python Success: Top 10 US Python Development ProvidersYour One-Stop Shop for Python Success: Top 10 US Python Development Providers
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
 
June Patch Tuesday
June Patch TuesdayJune Patch Tuesday
June Patch Tuesday
 
Finale of the Year: Apply for Next One!
Finale of the Year: Apply for Next One!Finale of the Year: Apply for Next One!
Finale of the Year: Apply for Next One!
 
Trusted Execution Environment for Decentralized Process Mining
Trusted Execution Environment for Decentralized Process MiningTrusted Execution Environment for Decentralized Process Mining
Trusted Execution Environment for Decentralized Process Mining
 
Letter and Document Automation for Bonterra Impact Management (fka Social Sol...
Letter and Document Automation for Bonterra Impact Management (fka Social Sol...Letter and Document Automation for Bonterra Impact Management (fka Social Sol...
Letter and Document Automation for Bonterra Impact Management (fka Social Sol...
 
Deep Dive: Getting Funded with Jason Jason Lemkin Founder & CEO @ SaaStr
Deep Dive: Getting Funded with Jason Jason Lemkin Founder & CEO @ SaaStrDeep Dive: Getting Funded with Jason Jason Lemkin Founder & CEO @ SaaStr
Deep Dive: Getting Funded with Jason Jason Lemkin Founder & CEO @ SaaStr
 
Building Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and MilvusBuilding Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and Milvus
 
dbms calicut university B. sc Cs 4th sem.pdf
dbms  calicut university B. sc Cs 4th sem.pdfdbms  calicut university B. sc Cs 4th sem.pdf
dbms calicut university B. sc Cs 4th sem.pdf
 
Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...
Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...
Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...
 
AWS Cloud Cost Optimization Presentation.pptx
AWS Cloud Cost Optimization Presentation.pptxAWS Cloud Cost Optimization Presentation.pptx
AWS Cloud Cost Optimization Presentation.pptx
 
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAUHCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
HCL Notes und Domino Lizenzkostenreduzierung in der Welt von DLAU
 

SplunkLive! Utrecht 2018 - Customer presentation: POST Luxembourg

  • 1. Telco Fraud Detection and Mitigation Cu D. Nguyen, Ph.D. Data Scientist and Security Architect POST Luxembourg November 2018
  • 2. POST Luxembourg Telecom Services, Infrastructures & ICT Postal/Courrier & Logistique Financial Services 4371 employees 43 nationalities
  • 3. My Background and Role ▶ Data Scientist and Security Architect at Post Luxembourg ▶ Machine learning, computer security, software engineering ▶ Security blue team: ▶ Visibility, Intelligence, and Action ▶ Innovation ▶ “Splunk> see the forest, and the trees” Cu D. Nguyen, Ph.D.
  • 4. Telco fraud – a multi-million-dollar-a-year problem
  • 5. PBX hacking ▶ A telephone system within an enterprise ▶ Switching calls among local users and share external phone lines What is a PBX? And when it’s hacked, what happens? ▶ Attackers/fraudsters control the PBX, making premium rate (expensive) calls
  • 6. A deep-dive into a PBX hacking fraud Hacked phone numbers Premium phone numbers owned by fraudsters
  • 7. A deep-dive into a PBX hacking fraud A well-organized crime: • 19 calling numbers from the hacked PBX • 1000+ destination numbers all over the world • Cost ~50K euros if not handled
  • 8. What we’ve learned Fraudsters are well-organized and evolving Running AFTER them, we need to be FAST and PRECISE! BigData Analytics Machine Learning Automation
  • 9. Comprehensive Quality & Governance ▶ Filtering ▶ Anonymizing ▶ Parsing ▶ Enriching ▶ Role-based access control ▶ Auditability Extendibility and Scalability ▶ Scalable in a linear fashion ▶ Apps & TAs Why Splunk? hours weeks
  • 10. Splunk at Post Luxembourg Spam/Fraud detectors Voice Mobile & Fix SMS/MMS Block/unblock API On Telecom Gateways Network CDRs Machine learning IT DDoS TIDS DevOps • 62.5M events/day • Approx. filtered 80GB/day Fraud management GUI
  • 11. Fraud detection using machine learning  Use historical data for training models (detectors)  Use the trained models for classifying new data  Frequent retraining to catch new patterns Image source: http://www.cognub.com/index.php/cognitive-platform/
  • 12. Fraud detection using Splunk ML Toolkit normal cases frauds Features: number of calls, number of targets, destination countries, cost, duration …. Models: Random Forest (+ statistical models)
  • 13. Encouraging results Hacked numbers being detected and blocked automatically
  • 14. What’s next? ▶ Evolving telco frauds meet evolving solutions ▶ Faster ▶ Broader, covering more cases ▶ Smarter, being more precise and dealing with new patterns ▶ Machine learning ▶ From supervised to semi or unsupervised, in collaboration with University of Luxembourg ▶ AutoML (algorithm selection and hyperparameter tuning)
  • 15. © 2018 SPLUNK INC. Key Takeaways