Detecting VoIP calls hidden in web traffic

IEEE Transactions on Network and Service Management

Volumn 5, Issue 4, 2008, Pages 204-214

  Freire, Emanuel P ^a   Ziviani, Artur ^b   Salles, Ronaldo M ^a  

^a MILITARY INSTITUTE OF ENGINEERING   (Brazil)

^b LABORATÓRIO NACIONAL DE COMPUTAÇÃO CIENTÍFICA   (Brazil)

Author keywords

Aggregates; Data mining; HTTP traffic; Internet; Network anomaly detection; P2P VoIP systems; Peer to peer computing; Protocols; Skype; Training; Web pages

Indexed keywords

HTTP TRAFFIC; NETWORK ANOMALY DETECTION; P2P VOIP SYSTEMS; PEER TO PEER COMPUTING; PROTOCOLS; SKYPE; TRAINING; WEB PAGES;

FAULT TOLERANT COMPUTER SYSTEMS; HTTP; INFORMATION MANAGEMENT; INTERNET; INTERNET SERVICE PROVIDERS; INTERNET TELEPHONY; MINING; VOICE/DATA COMMUNICATION SYSTEMS; WORLD WIDE WEB;

INTERNET PROTOCOLS;

EID: 67449104703     PISSN: 19324537     EISSN: None     Source Type: Journal    
DOI: 10.1109/TNSM.2009.041102     Document Type: Article

References (42)

1. B. Rao, B. Angelov, and O. Nov, "Fusion of disruptive technologies: lessons from the Skype case," European Management J., vol. 24, no. 2-3, pp. 174-188, 2006.
2. IANA, "Port numbers," http://www.iana.org/assignments/port-numbers.
3. T. Karagiannis, K. Papagiannaki, and M. Faloutsos, "Blinc: Multilevel traffic classification in the dark," in SIGCOMM'05: Proc. 2005 ACM Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications, 2005, pp. 229-240.
4. C. Fraleigh, S. Moon, B. Lyles, C. Cotton, M. Khan, D. Moll, R. Rockell, T. Seely, and C. Diot, "Packet-level traffic measurements from the Sprint IP backbone," IEEE Network, vol. 17, no. 6, pp. 6-16, 2003.
5. T. Karagiannis, A. Broido, M. Faloutsos, and K. claffy, "Transport layer identification of P2P traffic," in IMC '04: Proc. 4th ACM SIGCOMM Conference on Internet Measurement, 2004, pp. 121-134.
6. K. Sripanidkulchai, B. Maggs, and H. Zhang, "An analysis of live streaming workloads on the Internet," in IMC '04: Proc. 4th ACM SIGCOMM Conference on Internet Measurement, 2004, pp. 41-54.
7. Skype, http://www.skype.com/.
8. K. T. Chen, C. Y. Huang, P. Huang, and C. L. Lei, "Quantifying Skype user satisfaction," ACM SIGCOMM Computer Commun. Rev., vol. 36, no. 4, pp. 399-410, 2006.
9. Google Talk, http://www.google.com/talk.
10. E. P. Freire, A. Ziviani, and R. M. Salles, "Detecting Skype flows in Web traffic," in NOMS 2008: Proceedings of the 2008 IEEE/IFIP Network Operations and Management Symposium, 2008.
11. P. Barford and D. Plonka, "Characteristics of network traffic flow anomalies," in Proc. ACM SIGCOMM Internet Measurement Workshop, Nov. 2001.
12. A. Ziviani, M. L. Monsores, P. S. S. Rodrigues, and A. T. A. Gomes, "Network anomaly detection using nonextensive entropy," IEEE Commun. Lett., vol. 11, no. 12, pp. 1034-1036, Dec. 2007.
13. A. Moore and K. Papagiannaki, "Toward the accurate identification of network applications," in Proc. Passive and Active Measurement Workshop (PAM2005), Mar./Apr. 2005.
14. L. Bernaille, R. Teixeira, I. Akodkenou, A. Soule, and K. Salamatian, "Traffic classification on the fly," ACM SIGCOMM Comput. Commun. Rev., vol. 36, no. 2, pp. 23-26, 2006.
15. J. Ma, K. Levchenko, C. Kreibich, S. Savage, and G. M. Voelker, "Unexpected means of protocol inference," in IMC '06: Proc. 6th ACM SIGCOMM Internet Measurement Conference, 2006, pp. 313-326.
16. Y. J. Won, B.-C. Park, H.-T. Ju, M.-S. Kim, and J. W. Hong, "A hybrid approach for accurate application traffic identification," in Proc. 4th IEEE/IFIP Workshop on End-to-End Monitoring Techniques and Services Apr. 2006, pp. 1-8.
17. E. P. Freire, A. Ziviani, and R. M. Salles, "On metrics to distinguish Skype flows from HTTP traffic," in LANOMS 2007: Proc. 5th Latin American Network Operations and Management Symposium, Sept. 2007.
18. B. A. Mah, "An empirical model of HTTP network traffic," in INFOCOM '97: Proc. 16th Joint Conference of the IEEE Computer and Communications Societies, 1997.
19. H.-K. Choi and J. O. Limb, "A behavioral model of Web traffic," in ICNP '99: Proc. 7th International Conference on Network Protocols. IEEE Computer Society, 1999, pp. 327-334.
20. S. Baset and H. Schulzrinne, "An analysis of the Skype peer-to-peer Internet telephony protocol," in INFOCOM'06: Proc. 25th IEEE International Conference on Computer Communications, Apr. 2006.
21. S. Guha, N. Daswani, and R. Jain, "An experimental study of the Skype peer-to-peer VoIP system," in IPTPS'06: Proc. 5th International Workshop on Peer-to-Peer Systems, Feb. 2006, pp. 1-6.
22. D. Rossi, M. Mellia, and M. Meo, "Following Skype signaling footsteps," in IT-NEWS'08: Proc. 4th International Telecommunication Networking WorkShop on QoS in Multiservice IP Networks, Feb. 2008.
23. K. Suh, D. R. Figueiredo, J. Kurose, and D. Towsley, "Characterizing and detecting relayed traffic: A case study using skype," in INFOCOM' 06: Proc. 25th IEEE International Conference on Computer Communications, Apr. 2006.
24. Y. Yu, D. Liu, J. Li, and C. Shen, "Traffic identification and overlay measurement of Skype," in IEEE Int. Conf. on Computational Intelligence and Security, 2006.
25. S. Ehlert, S. Petgang, T. Magedanz, and D. Sisalem, "Analysis and signature of Skype VoIP session traffic," in Proc. CIIT 2006: 4th IASTED International Conference on Communications, Internet, and Information Technology, Nov./Dec. 2006, pp. 83-89.
26. B. Sat and B. Wah, "Analysis and evaluation of the Skype and Google Talk VoIP systems," in IEEE Int. Conf. on Multimedia and Expo, July 2006.
27. N. Kushman, S. Kandula, and D. Katabi, "Can you hear me now?!: It must be BGP," ACM SIGCOMM Comp. Commun. Rev., vol. 37, no. 2, pp. 75-84, 2007.
28. D. Bonfiglio, M. Mellia, M. Meo, N. Ritacca, and D. Rossi, "Tracking down Skype traffic," in INFOCOM'08: Proc. 2008 IEEE INFOCOM, Apr. 2008.
29. D. Bonfiglio, M. Mellia, M. Meo, D. Rossi, and P. Tofanelli, "Revealing Skype traffic: When randomness plays with you," in SIGCOMM'07: Proc. 2007 ACM SIGCOMM, Aug. 2007.
30. N. Ye and Q. Chen, "An anomaly detection technique based on a chi-square statistic for detecting intrusions into information systems," Quality and Reliability Engineering International, vol. 17, no. 2, pp. 105-112, 2001.
31. J. M. Estévez-Tapiador, P. García-Teodoro, and J. E. Díaz-Verdejo, "Measuring normality in HTTP traffic for anomaly-based intrusion detection," Computer Networks, vol. 45, no. 2, pp. 175-193, June 2004.
32. K. Pearson, "On the criterion that a given system of deviations from the probable in the case of a correlated system of variables is such that it can be reasonably supposed to have arisen from random sampling," Philos. Mag. Series 5, vol. 50, pp. 157-172, 1900.
33. F. J. Massey, Jr., "The Kolmogorov-Smirnov test of goodness of fit," J. Amer. Statist. Assoc., vol. 46, pp. 68-78, 1951.
34. M. Handley, H. Schulzrinne, E. Schooler, and J. Rosenberg, "SIP: Session Initiation Protocol," Internet RFC 2543, 1999.
35. X. Wang, S. Chen, and S. Jajodia, "Tracking anonymous peer-to-peer VoIP calls on the Internet," in CCS'05: Proc. 12th ACM conference on Computer and communications security, 2005, pp. 81-91.
36. Extensible Messaging and Presence Protocol (XMPP), http://www.xmpp.org.
37. XEP-0166: Jingle, http://www.xmpp.org/extensions/xep-0166.html.
38. V. Jacobson, C. Leres, and S. McCanne, "tcpdump," http:// www.tcpdump.org/.
39. J. Elson, "tcpflow," http://www.circlemud.org/~jelson/software/tcpflow/.
40. N. A. Macmillan and C. D. Creelman, Detection Theory: A User's Guide Cambridge University Press, 1991.
41. M. Perényi, A. Gefferth, T. D. Dang, and S. Molnár, "Skype traffic identification," in Proc. IEEE Globecom 2007, Washington, DC, USA, Nov. 2007.
42. M. Perényi and S. Molnár, "Enhanced Skype traffic identification," in Proc. 2nd International Conference on Performance Evaluation Methodologies and Tools - ValueTools'07, Nantes, France, 2007, pp. 1-9.