Communications and telecom intelligence

Lawful basis first

Network telemetry analytics

Modern networks stream model-driven telemetry over gNMI with YANG data models, alongside SNMP polling, syslog and IPFIX flow records. We ingest these into a streaming platform such as Kafka, store them in a time-series and columnar layer, and build analytics on top:

• Topology-aware alarm correlation. The network graph lets a failed transport link suppress the hundreds of downstream alarms it causes, so the NOC sees one root cause instead of an alarm storm.
• KPI anomaly detection. Seasonal decomposition and per-element baselines catch slow degradation that fixed thresholds miss, with isolation forests over multivariate KPI vectors for faults that show in combinations of metrics.
• Capacity forecasting. Probabilistic forecasts of link and site utilisation with prediction intervals, so upgrades are planned from the upper bound rather than the mean.

CDR, IPDR and xDR analytics

Call detail records, IP detail records and probe-generated xDRs describe who used which service, when, where and for how long, without content. They arrive in very high volumes, so we store them as partitioned columnar data (Parquet, partitioned by time and cell) and push aggregation down to the query engine. Subscriber identifiers are pseudonymised with keyed hashing and periodic key rotation before analysts touch the data, and any output shared outside the operator is aggregated with minimum group sizes so individuals cannot be singled out. Typical uses are customer-experience scoring per subscriber, churn models, mobility analytics from cell sequences and the fraud models below.

RF spectrum monitoring with SDR

Receive-only software-defined radio sensors capture IQ samples across a band of interest. Processing runs FFTs into spectrograms, energy detection with CFAR thresholds, and channel occupancy statistics by time of day. For interference hunting, such as an unknown carrier degrading a cell site, several time-synchronised sensors estimate the emitter's location by time difference of arrival or angle of arrival. The output is a characterised signal (frequency, bandwidth, duty cycle, location estimate) that an operator can take to the ACMA, not decoded content.

Signal classification

Deep networks trained directly on IQ samples, convolutional or transformer-based, classify modulation and waveform type with no hand-built features: narrowband FM, frequency-hopping spread spectrum, LoRa chirps, OFDM carriers and more. We train on captures from your own environment as well as public research data, because real multipath, interference and receiver impairments are what break models trained only on synthetic signals. Defensive uses include detecting rogue or unauthorised transmitters and fake base stations, by comparing observed cell broadcast parameters with the operator's own network plan.

Telecom fraud

• SIM swap and port-out fraud. Account takeover by moving a victim's number to an attacker's SIM. The ACMA's Customer Identity Authentication Determination 2022, in force since 30 June 2022, requires multi-factor identity authentication for high-risk interactions including SIM swaps. We score each swap or port request using recent account changes, device and channel signals and unusual location, and can share a risk signal with banks, where the money is usually stolen next.
• International revenue share fraud (IRSF). Artificially inflated traffic to high-cost international number ranges, often through a compromised PBX. Signals are sudden bursts to rarely called ranges, sequential dialled numbers and out-of-hours call spikes.
• Wangiri. Mass one-ring calls from international numbers that bait callbacks to premium-rate ranges. Detection looks for high volumes of very short, unanswered calls sweeping sequential number blocks.
• SIM boxes. Banks of SIM cards that terminate international traffic as local calls to bypass interconnect charges. Their signature is many outgoing calls, almost no inbound calls or SMS, a static serving cell, many distinct called numbers and shared device identifiers.
• Scam calls and SMS. Industry code C661:2022 Reducing Scam Calls and Scam SMs, published through the telecommunications industry body and registered by the ACMA in July 2022, requires carriers to identify, trace and block scam traffic. The Scams Prevention Framework Act 2025, assented on 20 February 2025, sets obligations for sectors as they are designated, with telecommunications among the first expected.
• Signalling abuse. SS7 and Diameter messages used for unauthorised location queries or traffic redirection. We baseline message types by originating network and flag anomalies from signalling firewall logs.

RAN and network performance AI

Radio access network models work from per-cell KPIs: RSRP, RSRQ, SINR, physical resource block utilisation, RRC setup success, handover success and dropped calls. We detect sleeping cells whose alarms stay silent while traffic collapses, forecast load to schedule carrier shutdown for energy saving, and recommend parameter changes with the evidence attached. In O-RAN architectures these run as near-real-time RIC xApps or non-real-time rApps. Closed-loop actions are tested against a network digital twin first and run inside guardrails that limit how far and how fast any parameter can move.

Metadata analytics for authorised users

For agencies acting under their own legal authority, we build link analysis over lawfully obtained metadata with case-based access control, the authorisation reference stored with every dataset, retention tied to that authorisation and full audit logging. The tooling enforces minimisation: it never widens what an authorisation permits.

Questions