Detecting Spam in VoIP networks

Transcription

1 Detecting Spam in VoIP networks Ram Dantu, Prakash Kolan Dept. of Computer Science and Engineering University of North Texas, Denton Presentation: Heikki Ollikainen /53089D

2 Presentation Introduction Architecture Experimental setup Results Conclusions

3 INTRODUCTION VoIP is aggressively deployed in current networks IPPBX > traditional PBX deployments (2006) Very little reported security analysis against threats like DOS, session hijack, termination, monitoring, eavesdropping etc. Impact of vulnerabilities is not understood All the threats need to be addressed before VoIP is deployed in mass scale. While there are many techniques to avoid spam, such techniques can be of limited application to avoid the problem of voice spam. The problem of spam in VoIP networks has to e solved in real time compared to systems.

4 INTRODUCTION Spam filters based on content analysis Content filtering is not useful for VoIP spam analysis as media flows in after the two participating entities have agreed upon to start the communication Too late to filter the call VOIP: to realize the objective of receiving a call from a person anywhere in the world, a static junk call filtering mechanism must have to be replaced with adaptive learning system. Voice Spam Detector (VSD) running along with the domain proxy and processes incoming call and inform proxy about the spam nature of the call based on the feedback from the end-user in its domain.

5 Architecture The architecture behind the spam detection process takes into account all the user preferences of wanted and unwanted people, his or her presence of mind, the reputation and trust of calling party.

6 Architecture Presence Depends on individuals state of mind to pick up the call. Step: synchronize individuals calendar with the system Filtering process: based on static/dynamic rules e.g. firewall rules. Rate limiting Based on known traffic patterns, signatures can be used to detect the rate of incoming calls. Velocity and acceleration values of the number of arriving calls from given user/host/domain can be used as a detection mechanism. When the velocity and acceleration reaches certain threshold value, the drop rate can be updated through feedback control. Once the spam is detected, PID (Proportional Integral Control) feedback control can be used to reduce the velocity of spreading.

7 Architecture Black and white list Most spam detection is done using a set of valid and invalid signatures. These signatures would tell detection server know which calls the server has to forward and which calls to block. Whitelist: allowed calls Blacklist: blocked calls Black and whitelists are constructed using user feedback to the VSD Bayesian learning The process of observing the calling party s behavior over period of time is termed as Learning. The spam probability can be calculated using Bayesian inference techniques. VSD filters out the calls, if the spam probability of the call would be greater than the permissible limit of tolerance level. Otherwise the call is forwarded to actual recipient of the call.

8 Architecture Social networks and reputation User s social network can be used to infer the associated relations between social elements. In VoIP social network represents the associated and trusted neighbors from which the user is willing to receive calls.

9 Experimental environment

10 Results (Fig 5, 6, 7, 8)

11 Conclusion VoIP technology is replacing PSTN rapidly. The problem of VoIP spam has to be resolved in real time compared to spam techniques. spam detection rely on content analysis Five stage process for analyzing whether VoIP call is valid or spam Combination of black/whitelist, trusted calling parties can be used accurately to identify if the call is spam or not. Learning process takes average 3 spam calls to confirm the call is spam. Filtering mechanism verified working with experimental test environment (large number of domains included).

12 Thank You!