A.3. Clue Definition Logic
To effectively detect Toll Fraud, Alarm Clues must produce an exact count of calls that match
the characteristics of a suspect phone call. Careful planning will allow you to create clues that
count suspect calls, and ignore the calls you don’t need.
A.3.1. Headers, Banners, and Other "Non-Data"
When you examine data produced by the PBX, you will often discover that in addition to call
records, the PBX also creates lines of text that do not contain call data. In order to avoid
counting this "non-data", clues must be carefully defined to exclude headers and other items.
In the example below, several call records are shown along with a header. The PBX might
generate the header after every 100 calls to identify the record fields. This is helpful when
defining the format, but can also be a nuisance when counting calls.
TIME EXT DUR NO. DIALED COST
A.3.2. The Comparative Operators
When the comparative operators (>,<,>=, and <=) are used, care must be taken to limit the
scope of the comparison.
When PollCat III compares information in a call record with values indicated in the clue
definition, it performs an "ASCII comparison". All ASCII characters are compared, not just
numbers. Each ASCII character, (including letters and symbols) has a numerical value.
Letters of the alphabet have a higher value than numbers, and symbols have a lower value.
Although call records may always have a numerical value in a specific field, "non-data" such
as headers and summaries, might have letters or symbols in that field. When creating an Alarm
Clue that includes the comparative operators, PollCat III must be prevented from counting
symbols and alphabetic characters as numerical values.
For example, if the variable "B" represents call duration and you wish to check for calls lasting
longer than 15 minutes, the definition would include the phrase "B>15:00". Unfortunately, this
would also count headers that have alphabetic text in the call duration field.
If your Alarm Clues are also counting non-data, the techniques described in the following
sections can be used to obtain a more reliable count.
PollCat III - Pollable Call Accounting Terminal, User's Guide Appendices