Detection of Encrypted Voice over IP (VoIP) Traffic

Abstract

VoIP usage is rapidly growing technology due to its cost e ectiveness, dra- matic functionality over the traditional telephone networks and its compati- bility to public switched telephone network (PSTN). In most of Middle East and Asian countries, like Pakistan, the commercial usage of VoIP is prohib- ited by national telecom authorities and they incurs loss of millions of rupees per year due to commercial usage of VoIP. Internet service providers may also want to prioritize VoIP from their paid customers. So Internet service providers (ISPs) and telecommunication authorities of these countries are interested in detecting VoIP calls to either prioritize or block VoIP tra c. Di erent techniques have been proposed for detecting VoIP such as port- based techniques, signature-based techniques, pattern-based techniques, and statistical analysis-based techniques. Port-based techniques, signature-based techniques, pattern-based detection is speci c to some of VoIP applications and protocols. For generic purpose, only statistical techniques are used for better results but existing statistical analysis-based techniques have some limitations and they could not provide more e cient and accurate solution to such organizations. In this thesis, we propose statistical analysis-based solution using threshold values of ow statistical parameters to detect the VoIP media (voice) ows. The solution is generic, e cient, accurate and real time (to some extent) and can detect encrypted, non-encrypted, and tunneled VoIP. It is independent from any VoIP application, protocol, secu- rity mechanism, or any tunneling mechanism and practically implementable at telecommunication authority or ISP gateway to either block or prioritize VoIP tra c. The proposed system is evaluated by accuracy, e ciency, and scalability. It has 97.54% direct rate (DR) and .00015% false positive rate (FPR). It detects VoIP calls from any VoIP application or protocol with 6 seconds. We compare our system with existing systems by accuracy and by features. Our system has better results and more features and ful lls the need of telecom operators and ISPs for detecting VoIP.