How does behavioural SMS analysis work?

Building the baseline

A baseline is not a single number. It is a profile per entity — per route, per Sender ID, per ESME account, per MSISDN range — describing what normal looks like across several dimensions and several time scales, from hour-of-day through to seasonal.

Baselines need enough history to be meaningful, which is the main reason monitoring mode runs before enforcement. An operator that enables blocking on day one has no baseline to compare against and will either over-block or catch nothing.

The characteristics that carry signal

Some dimensions are far more diagnostic than others:

• Volume and frequency per sender, and how sharply they change
• Destination distribution — a genuine subscriber messages a small, repeating circle; a SIM box messages thousands of unique numbers once each
• Content similarity across a sender's messages, which is high for automated traffic and low for conversation
• Timing regularity, including sending at hours when a human subscriber would be asleep
• Routing patterns and how consistently traffic uses the same path
• Delivery-receipt behaviour and success rates compared with peers on the same destination

From deviation to investigation

A deviation is a question, not a verdict. A retailer launching a campaign produces the same volume spike as a bypass operation coming online, and a legitimate new enterprise customer looks exactly like an unauthorised one until someone checks the commercial records.

The platform therefore scores the deviation, attaches the evidence, and routes it to an analyst. Cases that are confirmed become rules, registry entries or route actions; cases that are explained become part of the baseline, so the same alert does not recur.