Threshold-based generic scheme for encrypted and tunneled Voice Flows Detection over IP Networks

VoIP usage is rapidly growing due to its cost effectiveness, dramatic functionality over the traditional telephone network and its compatibility with public switched telephone network (PSTN). In some countries, like Pakistan, the commercial usage of VoIP is prohibited. Internet service providers (ISPs) and telecommunication authorities are interested in detecting VoIP calls to either block or prioritize them. So detection of VoIP calls is important for both types of authorities. Signature-based, port-based, and pattern-based VoIP detection techniques are inefficient due to complex and confidential security and tunneling mechanisms used by VoIP. In this paper, we propose a generic, robust, efficient, and practically implementable statistical analysis-based solution to identify encrypted, non-encrypted, or tunneled VoIP media (voice) flows using threshold values of flow statistical parameters. We have made a comparison with existing techniques and evaluated our system with respect to accuracy and efficiency. Our system has 97.54% direct rate and .00015% false positive rate.