The security layer the phone network never had. Nothing crosses unseen.▌

Illustrative: the sky behind this is a simulated call, not real traffic.

1. The problem

   ᚺ01 · The problemThe network today

   Caller ID is a text field.

   1. 01

      The phone network still takes a caller's word for who they are. A number is typed in, not proven.

   2. 02

      Robocallers rotate numbers faster than blocklists can list them, and spoof whatever looks trustworthy: your bank, your neighbour, your own area code.

   3. 03

      Signed caller identity helps, but only where it's present and actually checked.

   4. 04

      Static lists always lose. They block yesterday's number.

   Illustrative: the waveform behind this section is a simulated call.

   ---

2. The idea

   ᚨ02 · The ideaBuilt

   Guard the edge. Learn from every call.

   The web solved this years ago: a security layer at the edge that recognises clients by what they can't disguise, learns from everything it sees, and decides in milliseconds. Heimdall brings that idea to voice.

   • 01Built

     Fingerprint what can't be faked.

     A caller controls its number and its name. It doesn't control how its phone system builds call identifiers, orders its headers, or sends audio. The truth is in the disagreement: a caller that claims to be one thing while its signals say another.

   • 02Built

     Use voice's own identity layer.

     Heimdall checks the signature on the call's STIR/SHAKEN identity, including whether the signing certificate has been revoked, and trusts only the signer it actually verified.

   • 03Built

     Decide in flight, fail open.

     Every call is scored while it's being set up, within a 40 ms budget. If Heimdall can't answer in time, the call proceeds under your own rules, untouched.

   • 04Built

     Learn without framing the innocent.

     A number gains or loses reputation only when its identity was verified. A spoofed call can't damage the real owner of the number it borrowed.

3. How it works

   ᛁ03 · How it works

   Anatomy of a decision

   1. 01

      At the edge

      Astra's sideAstra: early access

      The network's own defences (rate limits, allow-lists, bans) do their job first.

   2. 02

      At admission

      Built

      Heimdall's 28 layers score the call before it's connected. Watch only, flag, or block: you choose.

      In Astra's first release, scores flag; only hard stops block.

      Astra's admission step is off by default.
   3. 03

      During the call

      Built for vendor analysisShadow mode

      Media signals, such as whether audio flows both ways.

   4. 04

      After the call

      Shadow mode

      Every record is analysed, and vendors are compared with their peers over the hour, day and week.

4. The fingerprint

   ᛞ04 · The fingerprint

   What a call gives away

   Fingerprint cardIllustrative

   Identity

   Claims: a signed local number≠Seen: no signature verified

   Stack

   Claims: a carrier's switch≠Seen: a softphone's header order

   Behaviour

   Claims: one person calling≠Seen: sequential dialling

   Network

   Claims: a carrier interconnect≠Seen: a remote handset

   Media

   Claims: a person answering≠Seen (vendor analysis): audio one way only

   Signaturehd1:id0-st.a7-bh3-nw.rh-md.1w

   ResultFour layers disagree with the claim: flag

   Illustrative: not a real call, number or signature. Media signals feed vendor analysis, not the call-time score.

   • Identity

     Built

     The verified signer, its certificate chain and revocation, and whether the calling number matches what was signed.

   • Stack

     Built

     How the caller's phone system generates branch IDs, call IDs and tags, and the order it writes headers in. Compiled phone systems can't easily change this.

   • Behaviour

     Built

     Velocity, sequential dialling, neighbour spoofing, short calls.

   • Network

     Built

     Where the call comes from, conditioned on who's calling: a carrier interconnect isn't judged like a remote handset.

     Network data from open sources only.

   • Media

     Built for vendor analysisNext: deeper media fingerprints

     Who answers, whether audio flows, how it's packetised.

   A caller can claim to be anything. It can't make all five agree.

5. Campaigns

   ᛚ05 · Campaigns

   See the campaign, not the number.

   What persists while numbers rotateNext: campaign clusteringIllustrative

   • 01The network today

     Robocall campaigns rotate numbers, but they reuse infrastructure: the same phone systems, the same signers, the same routes.

   • 02Built: the keysNext: campaign clustering

     Heimdall keys what it learns to what persists (the signer, the route, the stack) rather than a number that will be gone tomorrow.

   • 03Built

     Carriers are never punished for their customers. On a carrier interconnect, Heimdall looks through the peer to the originator and never learns reputation on the carrier itself.

   ᛖ06 · Two surfaces

   Two surfaces, two guards.

   • Next: the access guard

     Access

     Registered phones, remote extensions and softphones behave like web clients. Heimdall learns on network identity here.

   • Built

     Interconnect

     Carrier trunks carry many customers' calls. Heimdall reads the call, not the pipe.

   ---

6. 28 detection layers

   ᛚ07 · DetectionBuilt

   28 detection layers

   28 layers, in four groups, on every call

   • Identity

     Caller ID, STIR/SHAKEN attestation and the certificate behind it.

   • Behaviour

     Velocity, sequential dialling, neighbour spoofing, short calls.

   • Infrastructure

     IP, carrier and phone-system fingerprints.

   • Compliance

     Do-Not-Call, TCPA calling hours, consent.

   Both directions: robocalls out, fraud in.

7. Where it runs

   ᛁ08 · Where it runs

   Built into Astra. Standalone for PBXs.

   Watching every callShadow mode

   1. AstraCall records and events
   2. HeimdallReads them and scores
   3. Fraud signalsSent back to Astra
   4. Astra's fraud guardAlert, throttle, block

   Heimdall reads Astra's call records and events and sends fraud signals back. Astra's fraud guard applies its graduated response (alert, throttle, block). Nothing in the call path changes.

   At call admissionBuilt · off by default

   1. Call arrivesAt Astra's edge
   2. Astra's own checksUnchanged
   3. Heimdall checkOptional; shadow, dry run, live
   4. STIR/SHAKENSigning

   Optional, off by default: a check before STIR/SHAKEN signing, per customer and per trunk, from shadow to dry run to live.

   StandaloneBuilt

   1. Open-source PBXYour phone system
   2. HeimdallA native module

   A native module for open-source PBXs.

   Heimdall is a Lunar Systems product, and Astra, Lunar's hosted carrier platform, is its first integration.

8. Vendor fraud

   ᛖ09 · Vendor fraudShadow mode

   False answer supervision

   Heimdall compares each vendor with its peers: instant answers, no ringing first, very short billed calls, vendor-side releases, silent or one-way audio. Suspect vendors are flagged, and their cost disputed.

   Vendors against their peers · shadow modeIllustrative

   VendorSignalWindowAgainst peersVerdict

   • Vendor CInstant answersLast hourAbove peersFlag
   • Vendor AOne-way audioLast dayIn lineOK
   • Vendor FVery short billed callsLast weekFar above peersExclude
   • Vendor DVendor-side releasesLast hourIn lineOK
   • Vendor BNo ringing firstLast dayAbove peersFlag

   Vendors against their peers, illustrative

   Vendor	Signal	Window	Against peers	Verdict
   Vendor C	Instant answers	Last hour	Above peers	Flag
   Vendor A	One-way audio	Last day	In line	OK
   Vendor F	Very short billed calls	Last week	Far above peers	Exclude
   Vendor D	Vendor-side releases	Last hour	In line	OK
   Vendor B	No ringing first	Last day	Above peers	Flag

   ---

9. Safe by design

   ᛗ10 · SafetyBuilt

   Safe by design

   911933988

   Emergency calls

   Emergency calls (911, 933) and calls to 988 are never scored, delayed or blocked by Heimdall.

   • Built

     Rolled out safely

     Nothing is blocked until you decide: shadow → dry run → live.

   • Built

     Fails open

     If Heimdall can't answer in time, the call carries on under your existing rules.

   • Built

     Withheld numbers

     Callers who withhold their number stay private in every customer view, and withholding never counts against them.

   • Built

     Tamper-evident audit

     An append-only, hash-chained audit of every decision.

10. What's next

    ᛞ11 · What's next

    What's built, and what's next

    Built

    • The 28 layers
    • Stack fingerprints
    • Verified signer with revocation
    • Anti-framing reputation
    • Privacy
    • Fail-open
    • The audit

    Shadow mode

    • The Astra integration
    • Vendor false-answer detection

    Next

    • A SIP threat ruleset
    • PBX shield: credential-spray and scanner detection
    • Numbering intelligence (public numbering data)
    • A signer registry
    • Media-stack fingerprints
    • TLS client fingerprints

    After that

    • Passive transport fingerprints at the edge