The real-time decision-control platform for telecom operators.
Tellaris turns fragmented telecom events into real-time, governed decisions for fraud, revenue protection and business assurance. One behavioural model across signalling, CDR, roaming and billing, catching today's fraud and tomorrow's anomalies.
Tier-1 carriers run Subex, Mobileum, or custom-built fraud stacks staffed by 20-person teams. If you're an operator serving 1-20M subscribers, the licensing alone prices you out. Meanwhile SIM box bypass is draining your international termination revenue, Wangiri bots hit your subscribers overnight, and IRSF quietly inflates wholesale invoices you pay 60 days later.
One pipeline from stream ingestion to governed enforcement, and back again, entirely on your own infrastructure. Most events are scored and monitored silently. When a case crosses the action threshold, Tellaris fires a decision to your BSS, and the cases your team confirms sharpen detection over time.
Kafka-compatible streams from your mediation layer, rated-CDR exporters and signalling probes, or a mediation extract loaded as a file, under governed Avro contracts.
The stateful core joins voice, signalling and subscriber-profile signals in a single pass. Rules catch known patterns, ML scoring surfaces the novel ones, under 150ms end to end.
Block, rate limit, step-up review or a case workflow, under the policy you published. Every decision is logged with the signals that triggered it.
Analyst outcomes feed back as labels, so rule quality is judged on real traffic, and updated models are promoted onto the hot path without a redeploy.
Tellaris does not replace your fraud-management, revenue-assurance, BSS, charging or network-control platforms, and it does not sit in the call path. It reads a copy of the signalling and rated CDRs, applies the policy you published, and sends decisions only to the endpoints you name. A decision an operator cannot explain is a decision an operator cannot defend, so every one is recorded end to end.
See what the operator decided, and why. Every event is traceable through the full chain.
Tellaris consumes alerts, risk scores and events from the fraud, assurance and network platforms you already run, plus clearing-house feeds and in-house tooling, and adds subscriber, billing and roaming context across them. Nothing gets decommissioned to make room for it.
Rules are authored, versioned and published by your team, not configured behind a vendor support ticket. Changes move through an explicit review and promotion path, enforcement can be held pending approval, and protected subscribers stay out of enforcement entirely.
Decisions go only to the endpoints you configure, and each delivery is logged with its result. Publication history, the signals that fired, the tier applied and the dispatch outcome are all retained, so analysis, audit and compliance review read the same record.
An undocumented layout is the normal case. We parse headerless positional CSV and pipe-delimited mediation records, pin the column layout against the redundancy inside the file, and re-check it on every extract, so a shifted column fails loudly. Load an extract as a background job or through the batch loader, and the rules that run live produce the result.
Aris, the in-app assistant, works the same way. It reads alerts and rules to explain what fired, and drafts a rule or a disposition for review. It holds no write credential and cannot enforce anything. It is off by default, and an operator that will not send context to a model simply never turns it on.
Typologies share substrate features (velocity, fan-out, destination risk, subscriber deltas), so one streaming pipeline covers them all and extends as feeds onboard, alongside your existing systems and not one project per fraud type. Open a row for how each one is read.
International voice traffic re-terminated over GSM gateways to evade settlement. We detect the stationary SIM fanning out from one or two cells with nothing received, and the device churn that follows a SIM swap.
Primary signal Fan-out from a stationary cell + device churn after a SIM swap
Missed-call bots seeding callbacks to premium-rate numbers. We catch the campaign from both ends: the foreign caller ringing many of your subscribers for seconds each, and the callbacks that follow. In seconds, not after complaints land at customer care.
Primary signal Inbound caller fan-out + premium-rate callback
PBX compromise driving high-value calls to IPRN destinations, a SIM walking a number range to find destinations that pay out, and a line forwarding every incoming call abroad. We rate-limit and alert before the first full-hour session completes.
Primary signal Destination risk + foreign-callee fan-out + unconditional forward abroad
Impossible-velocity country flips and high-cost roaming abuse. We correlate location, velocity, and destination risk to catch it before the roaming invoice lands.
Primary signal Velocity + location + destination risk
Runaway consumption from PBX hijack, compromised SIMs, and tariff arbitrage. We cap spend before the loss compounds, rather than after the bill is cut.
Primary signal Usage spike + spend velocity
One subscription used across many handsets, with no SIM swap to explain the churn. Leakage by a paying customer rather than theft, so the default action caps spend instead of blocking.
Primary signal Device fan-out per subscriber, no recent SIM swap
Never-connected calls in bursts, or very short calls fanned out across many numbers in minutes. It is how SIM-box lines get tested and how dialer equipment sweeps a range, and it needs no high-risk destination to fire, so domestic probing is caught too.
Primary signal Zero-duration burst + short-call callee fan-out
Artificially inflated traffic on OTP and A2P flows, SIM farms sending from racked handsets, application senders fanning out across many destination countries, and SMS to high-risk prefixes. Metadata only. We read the traffic shape, not the message body.
Primary signal Send burst + sender fan-out + destination risk
Tethering resold as a service, a compromised device moving volume it never moved before, and reconnect loops opening sessions in bulk. Volume and session count are watched per subscriber per hour, on thresholds you set against your own traffic profile.
Primary signal Session volume + session-rate spike per subscriber
POS terminals, trackers and gateways run one SIM per device, so a corporate SIM appearing in a second handset means the SIM was moved. A companion rule watches your terminal APN for consumer-scale data, the signature of a SIM pulled out of a flat-rated device.
Primary signal Device fan-out on a non-consumer APN + APN volume
Every alert, including the ones below threshold, and every analyst disposition feeds a per-subscriber score that decays over clean behaviour. A subscriber tripping several weak signals across families gets an alert of its own, at most once a day, before any single rule would fire.
Primary signal Accumulated risk across rules + decay over clean traffic
A call, SMS or data session carried for a subscription you already suspended, barred or terminated. Your own subscriber-status extract is loaded and hot-reloaded, so a suspension takes effect on the next record rather than the next redeploy.
Primary signal Operator status list + any traffic on the line
Every layer of Tellaris is open-source or open-standard. The streaming fraud-detection blueprint (Kafka-compatible ingest, stateful operators, ML scoring) is a proven carrier-grade pattern. Tellaris productizes it: deployable in weeks for operators who don't have a 20-person streaming team.
| Layer | Technology | Note |
|---|---|---|
| Orchestration | Helm on k3s or vanilla Kubernetes | Self-host or managed |
| Detection engine | Stateful in-process decisioning · rules + ML scoring | Sub-150ms end-to-end |
| Ingestion | Kafka-compatible streaming · Avro schemas + registry | Backward-compatible CDR contracts |
| Enrichment | PostgreSQL + in-memory cache | Subscriber + destination risk features |
| Observability | Prometheus · Grafana · OpenTelemetry | Per-rule SLO dashboards |
Tellaris productises a detection approach with a track record in research and at carrier scale, on infrastructure operators already trust. The evidence, not a pitch.
Independent benchmark for ML-based international bypass detection. An industry reference, not a Tellaris result, and the accuracy bar our scoring is built to clear.
Every event is scored and acted on as it streams in, not surfaced in tomorrow's batch report. That is the gap static, after-the-fact tooling leaves open. Historical extracts replay through the same path, dated by when the fraud happened.
The scale of the problem, climbing yearly while prevention spend stays structurally underfunded. The case for getting ahead of it, not chasing it.
Belgian-incorporated. No third-party data brokers. Every decision is logged for analysis, audit and compliance review.
The questions that open every first call, answered before you have to book one. Anything specific to your network is a better conversation over a replay of your own CDRs.
Tellaris is a real-time decision-control platform for telecom operators. It turns fragmented events across signalling, CDR, roaming and billing into governed decisions on fraud, revenue protection and business assurance, using one live behavioural model rather than one tool per fraud type.
No. It runs alongside the fraud-management, revenue-assurance, BSS, charging and network-control platforms you already operate. Tellaris consumes their alerts, risk scores and events, together with clearing-house feeds and in-house tooling, adds cross-domain context, and applies consistent policy across all of them. Nothing gets decommissioned to make room for it.
No. It is passive and parallel by default, and it does not touch the call flow. Selected actions can be initiated through the endpoints you configure, once your policies have been validated, so nothing is dispatched anywhere you have not named. If Tellaris stops, every call still completes.
On voice and interconnect: SIM box bypass, Wangiri campaigns from both the inbound and the callback side, IRSF including outbound number scanning and unconditional call forwarding abroad, roaming fraud, zero and short-call probing, high-usage abuse and account sharing. On SMS: pumping and artificially inflated traffic, SIM farms, application-sender fan-out across destination countries, and SMS to high-risk destinations, all read from traffic metadata rather than message content. On data: session-volume and reconnect bursts, corporate or M2M SIMs moved into a second device, and terminal APNs moving consumer-scale data. Across all of them, a persistent per-subscriber risk score accumulates weak signals and raises its own alert, and traffic on a line you already suspended is caught against your own status list. Nineteen rule templates ship today, all reading one shared behavioural model. Typologies share substrate features such as velocity, fan-out, destination risk and subscriber deltas, so coverage extends across domains without a separate project per fraud type.
Under 150ms end to end, from CDR to alert, at p95. Every CDR is scored by every active rule as it streams in, in parallel to the call flow, rather than surfacing in tomorrow's batch report.
Both, through the same pipeline. A mediation extract can be imported in the app as a background job with live progress, or pushed through the batch loader, and it is evaluated by the same rules that run on the live feed. Windowed state runs on event time, so a historical load is dated by when the fraud happened rather than by when it was uploaded, and a replay of last quarter's traffic reads the same as it would have read live.
Kafka-compatible ingestion from your mediation layer, rated-CDR exporters and signalling probes, or simply a mediation extract as a file. The mix is yours to choose: Tellaris consumes whichever feeds you authorise, and GGSN / PGW, Diameter on the DRA and SS7/SIGTRAN widen what the rules can see as you publish them. An undocumented mediation layout is the normal starting point. We parse headerless positional CSV and pipe-delimited records and pin the column layout against the redundancy already inside the file rather than guessing, with a checker that re-runs that verification on every new extract. Ingest adapters carry governed Avro contracts once a feed is onboarded, so the platform adapts to your data rather than the other way around.
Two to three weeks to a customer-isolated deployment in passive mode, and about half a day to the first alert on a replay of your own CDRs.
Your team does. Rules are authored, versioned and published by the operator rather than configured behind a vendor support ticket, and changes move through an explicit review and promotion path. Thresholds, actions and scope are yours to set and yours to change, and protected subscribers stay out of enforcement entirely.
Yes. Every event is traceable through entity, journey, policy, decision, action and outcome. Publication history, the signals that fired, the tier applied and the dispatch result are all retained, so analysis, audit and compliance review read the same record.
Aris is an in-app assistant that helps analysts triage an alert or draft a rule. It is advisory by construction: its tools are read-only, it holds no write credential, and it cannot publish a rule or dispose of an alert. It drafts, and an analyst applies the draft under their own permissions or discards it. It is off by default per installation, so an operator that will not send context to a model simply never enables it.
In your infrastructure, on-premises or in your private cloud, with no SaaS dependency at runtime. Nothing leaves your network unless you configured the destination: there is no telemetry, no licence check and no call-home of any kind, and there are no third-party data brokers. We provide a GDPR Article 28 data processing addendum, and log lines carry a truncated digest rather than the subscriber number. Tellaris is Belgian-incorporated and runs its controls against ISO/IEC 27001:2022.
Bring one hour of anonymized CDRs to the demo call. We'll show you the fraud patterns our pipeline finds, which rules trigger, and which ML scores surface the non-obvious cases. 30 minutes, no slides.