A Technical Deep Dive into Heksagon’s Juniper Platinum Award-Winning Voice Firewall

According to Juniper Research's 2026 voice security predictions, mobile subscribers are expected to receive more than 380 billion fraudulent calls this year alone, a figure forecast to climb to 394 billion by 2028. Projected losses from mobile voice fraud are expected to peak at $415 billion in 2028, with cumulative losses from 2026–2028 potentially exceeding $1 trillion.

The same research flags a structural shift in the threat landscape. Generative AI enables voice cloning at scale, highly convincing impersonation scripts, and the construction of synthetic calls that defeat traditional heuristics. Static, rule-based CDR batch processing approaches (the industry norm for years) are no longer adequate.

This is the environment in which the Juniper judges evaluated different voice firewall solutions and decided that Heksagon’s stands out.

Core Architecture: Real-Time, Pre-Call Interception

The central design principle of our Voice Firewall solution (VFW) is interception before call setup, instead of post-call analysis. This distinction matters operationally: catching a fraudulent call before it completes eliminates the revenue leakage, subscriber impact, and downstream remediation work that reactive systems require.

VFW integrates directly into the operator's core network via real-time call control interfaces. It supports both SIP-based IP networks and legacy TDM infrastructure:

• SIP networks: Integration via SIP proxy, SIP loopback proxy, or SIP redirect with SIP mirroring
• SS7/SIGTRAN networks: Integration as a CAMEL/INAP SCP (standalone trigger) or as a proxy of existing CAMEL/INAP signaling
• IMS/VoLTE/VoWiFi/VoNR: Full ISC SIP integration with IMS core for 4G and 5G deployment

Every call is analyzed at the call setup stage. The system examines the full set of available signaling parameters (calling/called/redirecting numbers, Nature of Address, carrier, Cell-ID, Calling Party Category) and makes a disposition decision in real time.

This dual-stack support is significant. Most MNOs run hybrid networks. A firewall that only operates on SIP or only on SS7 creates coverage gaps. Heksagon closes those gaps with consistent policy enforcement across all call types.

Detection Logic: Scenarios, Filters, and Real-Time Analytics

Detection in VFW is organized around scenarios (user-configurable rule sets that combine filters with actions). Each scenario defines one or more filters; when a call matches all filters in a scenario, the corresponding action fires immediately.

The system supports three distinct processing paths, which can be combined within a single scenario:

Path 1: Immediate rule-based response

The system evaluates call parameters against configured rules and number lists (blacklists, whitelists, suspect lists, regulatory numeration, MNP data). This is the fastest path, with sub-second response times. It covers high-confidence fraud patterns: calls from blacklisted ranges, missing or invalid CLIs, numeration inconsistencies with agreed interconnect traffic profiles.

Path 2: Active check methods

For calls that require additional verification, the system executes real-time queries to external resources before making a decision. Supported active checks include HLR lookups (to verify subscriber registration and roaming status), callback checks (to confirm the calling party's availability and catch Wangiri setups), IVR-based Voice CAPTCHA (to distinguish human callers from machine-generated robocalls), and State Server queries (to correlate against recent call history aggregates).

Path 3: Real-time analytics with profile evaluation

The State Server maintains continuously updated aggregates across sliding time windows  (call volume, minute volume, spread metrics, short-call ratios, distinct destinations). When a call arrives, its parameters are compared against these profiles. Deviations from baseline trigger actions. This is the layer that catches IRSF traffic inflation, Wangiri callback schemes, and PBX hacking attacks in progress, rather than in a post-event batch report.

The scenario library is continuously developed in alignment with GSMA FASG guidance and real-world operational intelligence from the 30+ MNOs in Heksagon's deployment base. Key coverage areas include:

• SIMBox and Bypass Fraud
• CLI Spoofing
• IRSF and Wangiri
• Voice DDoS
• Flash Call Management
• Robocalls and Spam

Juniper's Head Judge Sam Barker identified two specific technical differentiators in Heksagon's submission: substantial innovation in threat mitigation and multi-layered intelligence. The award citation noted the integration of LLM-based speech recognition and digital voice signatures as forward-looking capabilities directly relevant to the AI-based fraud threat.

Beyond the technical specifics, the award recognized the combination of:

• Breadth of fraud coverage: a single platform addressing bypass, IRSF, CLI spoofing, DDoS, flash calls, and emerging AI-based threats
• True real-time operation: pre-call interception across both SIP and SS7/SIGTRAN, not batch CDR analysis
• Operational maturity: 15+ years of deployment history, with one of the world's first real-time voice firewalls launched in 2012, and the first Call Validation Solution deployed outside North America in 2016
• Scale validation: 600 million subscribers protected, 9 million fraudulent calls blocked monthly, across more than 15 countries
• Precision at scale: a false positive rate of 0.01%, ensuring legitimate calls are not disrupted while fraudulent traffic is blocked in real time

Heksagon is an active member of GSMA FASG, CFCA, ATIS, and One Consortium. This industry participation means our scenario library reflects actual fraud intelligence from operator networks globally, not just lab-derived threat models.

The most significant threat vector emerging in 2026 is AI-generated voice fraud: calls where a synthetic voice, cloned from publicly available audio of a real person is used to impersonate executives, bank representatives, or government officials. These calls defeat traditional CLI-based detection because the caller ID may be legitimate; the fraud is in the content and voice characteristics of the call itself.

Heksagon is currently developing capabilities to address this at the network layer. The upcoming platform release will introduce:

• Digital voice signatures: For every human speaking over phone calls, a unique digital voice ID will be created. It acts as a voice signature analogous to CLI for traditional and legacy calling systems. This voice ID will differentiate between real human-based and AI-generated bot voices for fraud detection purposes.  
• LLM-based speech recognition for fraud detection: real-time analysis of call content to identify scripted social engineering patterns, impersonation attempts, and synthetic speech artifacts. This capability allows the system to flag calls where the voice characteristics diverge from expected patterns for the claimed originating identity.

These capabilities are designed to integrate into the existing VFW scenario framework. Operators will be able to define scenarios that combine traditional signaling-layer checks with voice-content analysis, creating a genuinely multi-layered defense against next-generation AI-based scams.

The Juniper Platinum Award reflects where the voice fraud problem is heading, not just where it's been. The traditional combination of blacklists, CDR batch analysis, and basic CLI validation is structurally outpaced by fraudsters using generative AI, SIM farms, and coordinated interconnect bypass schemes.

Heksagon's Voice Firewall addresses this through a pre-call, real-time interception architecture that operates across SIP, SS7/SIGTRAN, and IMS simultaneously, supported by active check methods, profile-based real-time analytics, and a continuously updated scenario library grounded in actual operator intelligence.

To discuss how the platform’s current and upcoming capabilities apply to your network, get in touch with our team.