Functionality

The following description is based on a prototype implementation that has been presented by Dirk Lentzen in Japan in the year 2011 (see publications).

Let’s explain the system with two examples and some screenshots. Images can be enlarged by clicking on them.

First example (a minimal scenario):

In this example, five calls are generated at Asterisk A (representing an incoming call trunk) and via the SER SIP proxy sent to Asterisk B (which is in the terminating VoIP network). At Asterisk B, an audio fingerprint is computed and then stored in a database. A database query compares new fingerprints to the existing feature vectors.

viat_system7-Architektur
5 calls are generated, call no. 1, 2 and 5 are spit calls and call no. 3 and 4 are regular calls. The simulation is started at Asterisk A:

Found 5 Callfiles.
Simulationszeit: 2010-03-28 11:00:00
Call: /home/viat/scenario/minimal/callfiles/call01-spit.call

Simulationszeit: 2010-03-28 11:00:30
Call: /home/viat/scenario/minimal/callfiles/call02-spit2.call

Simulationszeit: 2010-03-28 11:01:00
Call: /home/viat/scenario/minimal/callfiles/call03-normalerAnruf1.call

Simulationszeit: 2010-03-28 11:01:30
Call: /home/viat/scenario/minimal/callfiles/call04-normalerAnruf2.call

Simulationszeit: 2010-03-28 11:02:00
Call: /home/viat/scenario/minimal/callfiles/call05-spit3.call

The first two SPIT calls (and the regular calls) go through with the usual SIP message flow:

palladion4

After two SPIT calls with identical or similar audio data, the VIAT SPIT detection engine fires and puts the caller URI on the blacklist of the SIP proxy SER. Call no. 5 (which is the third SPIT call) is then blocked ! In the chart below, the fifth call (depicted by the green line) fails.

palladion2

The SPIT call is blocked with a 603 decline messge:

palladion3

Second Example (a scenario with various SPIT calls):

Here, 25 SPIT calls are repeatedly injected. These are five versions of five different audio files (slightly modified by noise).

Found 25 Callfiles.
Simulation:
Simulationszeit: 2010-03-28 11:00:00
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000014.call
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000007.call
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000012.call
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000018.call
Simulationszeit: 2010-03-28 11:00:30
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000010.call
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000017.call
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000007.call
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000006.call
Simulationszeit: 2010-03-28 11:01:00
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000022.call
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000004.call
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000018.call
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000006.call
Simulationszeit: 2010-03-28 11:01:30
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000025.call
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000025.call
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000011.call
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000025.call
Simulationszeit: 2010-03-28 11:02:00
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000013.call
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000007.call
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000001.call
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000022.call
Simulationszeit: 2010-03-28 11:02:30
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000010.call
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000021.call
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000008.call
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000012.call
Simulationszeit: 2010-03-28 11:03:00
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000006.call
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000021.call
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000015.call
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000021.call
Simulationszeit: 2010-03-28 11:03:30
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000022.call
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000021.call
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000011.call
 Call: /home/viat/scenario/normal-spit/callfiles/Spitcall000018.call

After the learning phase, the system begins to block the first SPIT calls (green lines):

palladion5

After some time, all SPIT callers are blacklisted and their calls are all blocked:

palladion6