Skype‐Hunter: A real‐time system for the detection and classification of Skype traffic

Abstract

In the previous years, Skype has gained more and more popularity, since it is seen as the best VoIP software with good quality of sound, ease of use and one that works everywhere and with every OS. Because of its great diffusion, both the operators and the users are, for different reasons, interested in detecting Skype traffic.In this paper we propose a real-time algorithm (named Skype-Hunter) to detect and classify Skype traffic. In more detail, this novel method, by means of both signature-based and statistical procedures, is able to correctly reveal and classify the signaling traffic as well as the data traffic (calls and file transfers). To assess the effectiveness of the algorithm, experimental tests have been performed with several traffic data sets, collected in different network scenarios. Our system outperforms the 'classical' statistical traffic classifiers as well as the state-of-the-art ad hoc Skype classifier.

The Parrot Is Dead: Observing Unobservable Network Communications

“…Users are authenticated by a central login server. A Skype supernode is a resource-rich user with a public IP address and sufficient CPU, memory, and network bandwidth [1,5]. Supernodes relay media and signals between clients that cannot communicate directly due to network address translation (NAT) and firewalls.…”

“…In fact, similar tools have been proposed for real-time detection of Skype traffic [9,23], including line-rate detectors by Patacek [47], who used these tests in an NfSen 6 plugin, and by Adami et al [1]. These tools can be adapted to detect Skype parrots that pass a nontrivial fraction of the tests, but not all of them.…”

“…There are two kinds of UDP probes, long and short, consisting of four-and two-packet exchanges, respectively. These packets have characteristic sizes [1] and contents [47].…”

A Survey on Encrypted Traffic Classification

“…A two-phased method [27] was used to classify SSH tunnel traffic, in which the SSH traffic was identified firstly, and then the statistical attributes such as average packet length et al were used to classify the applications inside the tunnel. Adami D et.al [28] proposed a joint signature-based and statistical approach called Skype-Hunter to detect and classify Skype signaling and data flows in real time. Korczynski M et.al [29] presented a three-phase method for classifying SSL encrypted Skype service TCP flows based on statistical protocol identification, which distinguished voice calls, skypeOut, video conferencing, chat, file upload and download in different phases.…”

Voice over Internet Protocol (VoIP) Based IP PBX System Design

“…customers use a laptop to sort an email that's then separated into digital packets (groups of ones and zeros) that are transported via a broadband -pipe‖ onto highspeed backbone networks. The packets are then reassembled at the destination account, which may be designed for access from any net connected computer anyplace within the world [7]. a few years past it absolutely was discovered that causing a symbol to a far off destination may have be done conjointly in a digital fashion: before causing it we've to digitalize it with an ADC (analog to digital converter), transmit it, and at the top rework it once more in analog format with DAC (digital to analog converter) to use it.…”