The Alarm Filters (Toll Fraud Detection)
|17:28|067|T.WILLIAMS |OUT|011811234567 |45:36|20.75|
|17:20|092|J.SMITH |OUT|18008547226 |01:07|00.00|
|17:21|002|P.BROWN |OUT|19495839514 |00:57|00.20|
Figure 9.9: Alarm Filter Format; Match Parameters Example 3
Example 3: Lengthy International Calls
This clue requires that you are familiar with the average duration of
international calls placed in the course of a normal day. For example, if
your average international call lasts about 10 minutes, and you are suddenly
billed for a two hour call, this could indicate phone abuse.
For this example, assume that the Alarm Filter Format is deﬁned as shown
in Figure 9.9. Note that the ﬁrst three lines in Figure 9.9 are sample call
records, and the fourth line is the Alarm Filter Format. The variables A, B,
and C are not used for this clue.
D is the ﬁeld that lists the ﬁrst seven digits of the number dialed.
E is the ﬁeld that lists the call duration.
Match Parameters for this Alarm Clue would be deﬁned as follows:
D=011---- Counts calls where the ﬁrst three digits of the number
dialed are "011". The remaining 4 digits are entered
as wild card characters (-).
* is the logical AND operator.
E>=20:00 Counts calls that last 20 minutes or longer.