The following description is based on a prototype implementation that has been presented by Dirk Lentzen in Japan in the year 2011 (see publications).
Let’s explain the system with two examples and some screenshots. Images can be enlarged by clicking on them.
First example (a minimal scenario):
In this example, five calls are generated at Asterisk A (representing an incoming call trunk) and via the SER SIP proxy sent to Asterisk B (which is in the terminating VoIP network). At Asterisk B, an audio fingerprint is computed and then stored in a database. A database query compares new fingerprints to the existing feature vectors.
5 calls are generated, call no. 1, 2 and 5 are spit calls and call no. 3 and 4 are regular calls. The simulation is started at Asterisk A:
Found 5 Callfiles. Simulationszeit: 2010-03-28 11:00:00 Call: /home/viat/scenario/minimal/callfiles/call01-spit.call Simulationszeit: 2010-03-28 11:00:30 Call: /home/viat/scenario/minimal/callfiles/call02-spit2.call Simulationszeit: 2010-03-28 11:01:00 Call: /home/viat/scenario/minimal/callfiles/call03-normalerAnruf1.call Simulationszeit: 2010-03-28 11:01:30 Call: /home/viat/scenario/minimal/callfiles/call04-normalerAnruf2.call Simulationszeit: 2010-03-28 11:02:00 Call: /home/viat/scenario/minimal/callfiles/call05-spit3.call
The first two SPIT calls (and the regular calls) go through with the usual SIP message flow:
After two SPIT calls with identical or similar audio data, the VIAT SPIT detection engine fires and puts the caller URI on the blacklist of the SIP proxy SER. Call no. 5 (which is the third SPIT call) is then blocked ! In the chart below, the fifth call (depicted by the green line) fails.
The SPIT call is blocked with a 603 decline messge:
Second Example (a scenario with various SPIT calls):
Here, 25 SPIT calls are repeatedly injected. These are five versions of five different audio files (slightly modified by noise).
Found 25 Callfiles.
Simulation:
Simulationszeit: 2010-03-28 11:00:00 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000014.call Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000007.call Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000012.call Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000018.call
Simulationszeit: 2010-03-28 11:00:30 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000010.call Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000017.call Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000007.call Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000006.call
Simulationszeit: 2010-03-28 11:01:00 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000022.call Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000004.call Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000018.call Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000006.call
Simulationszeit: 2010-03-28 11:01:30 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000025.call Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000025.call Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000011.call Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000025.call
Simulationszeit: 2010-03-28 11:02:00 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000013.call Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000007.call Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000001.call Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000022.call
Simulationszeit: 2010-03-28 11:02:30 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000010.call Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000021.call Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000008.call Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000012.call
Simulationszeit: 2010-03-28 11:03:00 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000006.call Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000021.call Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000015.call Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000021.call
Simulationszeit: 2010-03-28 11:03:30 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000022.call Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000021.call Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000011.call Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000018.call
After the learning phase, the system begins to block the first SPIT calls (green lines):
After some time, all SPIT callers are blacklisted and their calls are all blocked:
