Algorithm for determining excessive telephone traffic?

Question

Telephony

We thought about the algorithm for determining the hacking of the PBX at the client and fixing the excess traffic.
In fact, you need to analyze the nature of the client's traffic and find normal values ​​when it is not hacked and vice versa, identify traffic anomalies (the client is hacked). The problem is that each client may have his own mode of operation - someone calls a lot, someone a little. Someone has intercity calls, someone has mostly city calls, etc.
Need help, maybe someone already came up with such solutions?

Answer 1

For each day of the week, use the logs to determine the NNN, the load in it and the average load for the whole day. Average over several weeks (again, by days of the week) and select confidence intervals for all parameters by eye or by some Bayes theorem.

Answer 2

A simple equalization will work, but not very well, the average temperature in the hospital.
The method described above will give false positives on weekend days, seasonality will also need to be taken into account (a third of employees returned from vacation - get a peak).
Moreover, the client may have several employees, the nature of the calls is different for each.
How can a PBX be hacked? Draw another trunk? Get more clients? Steal the password from the client?
These events also need to be tracked, from which trunk the call came, to which it left. Have unknown clients appeared?
Well, etc.
PS: Soulful article - ivdon.ru/magazine/latest/n2y2012/742/

Answer 3

Thanks a lot! We will test.