Skip to main content

Anomaly Detection for Voice Alerts

Updated over 2 weeks ago

Anomaly Detection for Voice Alerts is a Bandwidth App feature that enables you to set up alerts for monitoring Inbound Calling and/or Outbound Calling and receive notifications when there is an anomaly in your voice traffic. This solution leverages machine learning and AI to understand your voice usage patterns and alert you when traffic falls outside expected patterns. For more information on the Anomaly Detection for Voice feature, please see our Anomaly Detection for Voice FAQ.

Accessing alerts

  1. Log in to the Bandwidth App.

  2. In the side navigation bar, select Insights.

  3. Select Alerts.

Note: If you’re unable to view the Alerts page, please ensure that your user has the Alerts user role enabled. Account and user permissions are required to view and create alerts.

This is where you can manage your alerts. The Configured Alerts table shows all alerts enabled on your account

Creating an alert

  1. Next to Configured Alerts, click Add New. This will take you to the Add Alert page.

  2. Under Name, create a name for the alert. The limit is 50 characters.

  3. Under Type, select Voice Anomaly.

  4. Under Metric, select All Metrics or any of the metrics available in the dropdown.

  5. Under Direction, select Inbound or Outbound.

  6. Review the Threshold field. The value is set to 80 by default but you can change it to a value between 0 and 100.

  7. Under Notification Frequency, select how frequently you want to be notified when the anomaly score threshold is exceeded. This can be between 10 minutes and 24 hours.

  8. Under Notification Method, select Email, Webhook, or both.

    • If you select Email, enter the email address where you want the alert to be sent. You can enter multiple email addresses, but only one email will be sent to each.

    • If you select Webhook, enter the Endpoint URL and HMAC Key.

  9. Click Save.

Notifications

Based on the notification method selected earlier, you’ll receive either an email, a webhook response, or both. The email will include the following:

  • Email subject: Bandwidth Anomaly Detection for Voice on Account [Account ID] [Warn/Alarm]: [Name of Alert]

  • Name of alert

  • Metric and alert type

  • Account Id

  • Date when the alert was triggered

  • Time when the alert was triggered

  • Alert metrics

    • Call direction configured

    • Anomaly Score

    • Actual Value of the metric

    • Expected Value of the metric

    • Volume of Attempted Calls at the time of Anomaly

Troubleshooting using Voice Anomaly Detection

  1. In the side navigation bar, select Insights and click Voice.

  2. Select Voice Anomaly Detection tab, choose Direction and Time Range, and click Apply Filter.

  3. Select the metric of interest and view the graph that displays the voice traffic pattern. If there is an anomaly, it will be displayed as a red dot on the graph.

Metric definitions

Metric

Description

Attempted Calls

Volume of Attempted Calls. An integer indicating the number of call attempts placed during a given time period.

Incomplete Calls

Volume of Incomplete Calls. An integer indicating the number of failed calls placed during a given time period. A failed call is defined as a call where sip_response_code != 200.

Completed Calls

Volume of Completed Calls. An integer indicating the number of successful calls placed during a given time period. A successful call is sip_response_code == 200.

4XX SIP Codes

An integer indicating the number of CDRs where SIP code is in the range 400 <= SIP code < 500. Typically customer-driven issues, such as “phone number not found” or “busy” (404, 486, 487, etc.).

5XX SIP Codes

An integer indicating the number of CDRs where SIP code is in the range 500 <= SIP code < 600. Typically network issues, whether internal or external, though typically more external, such as communicating with other carriers (503, etc.).

6XX SIP Codes

An integer indicating the number of CDRs where SIP code is in the range 600 <= SIP code < 700. Typically internal network issues. In a vacuum, these should practically never happen, and thus are “more severe” failure codes (603, etc.).

Answer-Seizure Ratio (ASR)

A decimal from 0 to 1 indicating the fraction of calls which successfully connect (return a 200 SIP code) out of all calls placed within a given time period.

Network Efficiency Ratio (NER)

A ratio similar to ASR, which expands the definition to see the ratio of calls that either succeeded, or were customer driven. This is done by including sip codes besides 200’s in the numerator of the ratio.

Note: SIP codes are not universal, and the SIP codes currently used for NER may not be appropriate for all customers and carriers. Currently, the definition for NER is the count of 200s, 404s, 486s, and 487s, divided by the total calls attempted.

Minutes of Use

Total minutes of use (sum of customer SBC call durations in minutes) in a given window.

Did this answer your question?