An effective empirical approach to VoIP traffic classi cation

Abstract

It is bene cial for telecommunication authorities and Internet service providers (ISPs) to classify and detectvoice traffic. It can help them to block unsubscribed users from using their services, which saves them huge revenues.Voice packets can be detected easily, but it becomes complicated when the application or port information in thepacket header is hidden due to some secure mechanism such as encryption. This work provides effective voice packetclassi cation and detection based on behavioral and statistical analysis, which is independent of any application, securityprotocol, or encryption mechanism. First we have made initial assessments through packet feature analysis followed bythe implementation of a voice detection algorithm to perform statistical analysis for classifying traffic over IP networks.The proposed voice detection algorithm is executed in three phases: registering of packet ow traces, signature-basedanalysis, and voice classi cation. In the rst phase, new packets are registered. In the second phase, registered packets aretested if they are already marked as detected. In the third phase, the voice detection algorithm works at distinguishingencrypted and nonencrypted voice ows by ne-tuning the parameters, which are chosen after a detailed statisticalanalysis of datasets on security protocols such as secure socket layer, secure session initiation protocol, and secure real-time transport protocol. Our results demonstrate a high true positive rate (TPR) and very low false alarm rate (FAR).The proposed methodology achieves a TPR of 93.6% for offline traces, 100% for the self-con gured voice setups, and95% for the online traffic. The FAR is 0.000084% for offline traces and 0.00020% for online traces, which shows that theproposed methodology is highly efficient and can be incorporated in contemporary telecommunication systems.