Oracle Communications Session Monitor captures network traffic, correlates it in real time, and stores it in an indexed format for reporting by the browser interface. A multi-layered architecture ensures scalability, reliability and cost-effectiveness.

The architecture has three layers:

• The Probe layer captures network traffic and performs Media Quality analysis.

• The Mediation Engine layer correlates network traffic and stores it for future reference. This layer also measures, manages and stores the KPIs. While there is usually one Mediation Engine per geographic site, one site may have multiple Mediation Engines or probes from multiple geographical sites may send traffic to a single Mediation Engine.

• The Aggregation Engine layer aggregates the global KPIs, with on-demand call correlation and global search features. In a typical setup, there is only one Aggregation Engine for the whole network.

The Session Monitor architecture consists of the Probe layer, Mediation Engine layer, and the Aggregation Engine layer (see the discussion about Session Monitor architecture in Session Monitor Installation Guide for information about the functions performed in each layer).

Fraud Monitor runs on the Aggregation Engine machine, but relies on the data provided by the Mediation Engines to detect fraud. For each established call, the Mediation Engine that has correlated the call, sends a notification to the Aggregation Engine, when the call is established, then one notification every few minutes and finally a notification at the end of the call. This allows Fraud Monitor to be aware of the real-time state of all the calls in the system and use this state to apply the different behavioral rules.