Fingerprints in the spectrum: Spectral analysis and detection of VolP traffic

Abstract

We propose a novel Voice over IP (VoIP) traffic detection approach which can penetrate some important barriers in front ofcommon traffic identification mechanisms: encryption, complexity and camouflage. First we use the information source, channel and destination model in the communication theory to reexamine our understanding ofInternet data flows. The packet, the Inter Arrival Time (IAT) between 2 successive packets and the payload length which are only of statistical meanings previously, are now assignedphysical properties as pulse, pulse arrival time and the amplitude. The packet-based Internet traffic is therefore transformed to a discrete-time pulse sequence. We then use spectral analysis to exhibit frequency domain behaviors of the general Internet background traffic and some typical VoIP traffics. The result reveals that all kinds of VoIP traffics have their own characteristics (i.e., peaks in certain frequencies) on the power spectrum. Experimental data on simulation as well as real life data set indicates that the approach is effective on recognizing VoIP traffics. We argue that the novel approach complements existing traffic identification mechanisms. The rationale behind it can also be applied to other fields. © 2009 IEEE.