WTI PollCat NetLink NLJ-VIP, User Manual

Page: 119 / 266

9-17
The Alarm Filters (Toll Fraud Detection)
|17:28|067|T.WILLIAMS |OUT|011811234567 |45:36|20.75|
|17:20|092|J.SMITH |OUT|18008547226 |01:07|00.00|
|17:21|002|P.BROWN |OUT|19495839514 |00:57|00.20|
-AAAAA-BBB-CCCCC------------DDDDDDD-----------EEEEE-------
Figure 9.9: Alarm Filter Format; Match Parameters Example 3
Example 3: Lengthy International Calls
This clue requires that you are familiar with the average duration of
international calls placed in the course of a normal day. For example, if
your average international call lasts about 10 minutes, and you are suddenly
billed for a two hour call, this could indicate phone abuse.
For this example, assume that the Alarm Filter Format is defined as shown
in Figure 9.9. Note that the first three lines in Figure 9.9 are sample call
records, and the fourth line is the Alarm Filter Format. The variables A, B,
and C are not used for this clue.
Where:
D is the field that lists the first seven digits of the number dialed.
E is the field that lists the call duration.
Match Parameters for this Alarm Clue would be defined as follows:
D=011----*E>=20:00
Where:
D=011----
Counts calls where the first three digits of the number
dialed are "011". The remaining 4 digits are entered
as wild card characters (-).
*
is the logical AND operator.
E>=20:00
Counts calls that last 20 minutes or longer.