SIP-Based VoIP Traffic Behavior Profiling and Its Applications

Abstract

With the widespread adoption of SIP-based VoIP, understanding the characteristics of SIP traffic behavior is critical to problem diagnosis and security protection of IP Telephony. In this paper we propose a general methodology for profiling SIP-based VoIP traffic behavior at multiple levels: SIP server host, server entity (e.g., registrar and call proxy) and individual user levels. Using SIP traffic traces captured in a production VoIP service, we illustrate the characteristics of SIP-based VoIP traffic behavior in an operational network and demonstrate the effectiveness of our general profiling methodology. In particular, we show how our profiling methodology can help identify performance anomalies through a case study.

SpamDetector: Detecting spam callers in Voice over Internet Protocol with graph anomalies

“…A call will be allowed if the current call pattern is similar to the previous call pattern of the caller, otherwise, the call is blocked. Features like call frequency and average call duration are used to compare previous call pattern with the current one , . Sengar et al use day, time of calling, and call duration parameters of users to create a pattern and use Mahalanobis distance between the current observation and pattern to detect anomalies.…”

“…Features like call frequency and average call duration are used to compare previous call pattern with the current one. 11,22,23 Sengar et al 24 use day, time of calling, and call duration parameters of users to create a pattern and use Mahalanobis distance between the current observation and pattern to detect anomalies.…”