VoIP Traffic Detection via Datagram Arrival Frequency Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods are inadequate for detecting Voice over IP (VoIP) traffic in network data traffic, especially when it is intended to evade detection, as they are often protocol-specific and unsuitable for counter-surveillance applications.
Innovation Solution
The method employs Fourier analysis to classify network data traffic by identifying constant-datagram-rate patterns using a sliding window function and threshold detection, capable of distinguishing VoIP traffic from other network traffic even when IP addresses and port numbers are unavailable, by analyzing datagram arrival times and frequency content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional protocol-specific methods are used to detect VoIP traffic, then detection is simple for known protocols, but detection fails against encrypted or evasive VoIP traffic
Solution Approach 1:
The patent implements a universal detection system that analyzes temporal patterns of network datagrams rather than relying on protocol-specific signatures. The system processes any datagram stream by examining inter-arrival times and applying Fourier analysis to detect periodic patterns characteristic of VoIP traffic, making it adaptable to encrypted, modified, or unknown protocols while maintaining detection accuracy
Solution Approach 2:
The system transforms the detection approach by changing from protocol-based parameters to temporal parameters. By analyzing the time intervals between datagram arrivals and applying spectral analysis to these temporal patterns, the system detects VoIP traffic based on its characteristic periodicity regardless of the underlying protocol or encryption, thus resolving the contradiction between reliability and adaptability
2Reliability
If Fourier analysis is applied to all network traffic without presorting, then comprehensive detection is achieved, but computational complexity increases significantly
Solution Approach 1:
The patent divides network traffic into separate streams based on datagram characteristics such as source/destination addresses, ports, or MAC addresses before applying Fourier analysis. This segmentation allows the system to process each stream independently with lower computational requirements while maintaining comprehensive detection coverage across all traffic types
Solution Approach 2:
The system applies Fourier analysis selectively to presorted streams that exhibit characteristics suggestive of VoIP traffic rather than analyzing all network traffic uniformly. By performing partial analysis on filtered streams, the system achieves effective detection coverage while reducing overall computational complexity
3Speed
If sliding window function is used with small window size, then detection responsiveness improves, but frequency resolution decreases
Solution Approach 1:
The patent employs a sliding window function that dynamically balances window size based on detection needs. The sliding mechanism allows the system to use smaller windows for rapid detection updates while maintaining sufficient frequency resolution through the continuous movement and overlapping of window segments, thus achieving both responsiveness and precision
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This approach effectively detects VoIP traffic with high accuracy, even in the presence of network anomalies and encrypted environments, and is robust enough to identify multiple VoIP streams, improving detection responsiveness and signal-to-noise ratio.
Implementation Method 1
Fourier analysis is performed on the datagram arrival times in the network data traffic to classify a set of network data traffic based upon potential constant-datagram-rate data content
Data Source
AI summary
A system and method of classifying a set of internet protocol network data traffic based upon potential constant-datagram-rate data content such as VoIP traffic or streaming video using frequency spectrum analysis of datagram arrival times is disclosed. The network data traffic is captured with an apparatus connected in-line on the network link from which the set of network data traffic is obtained or wirelessly from a wireless network transmission. The network data traffic is presorted based upon parameters such as the media access control-layer, datagram size, IP address, port number or transport-layer protocol to limit the required analysis. A threshold function is used to detect peaks in the calculated frequency spectrum that indicate constant-datagram-rate traffic. An automated system preferably captures the network data traffic, immediately performs the frequency spectrum analysis on the captured data traffic, and stores the analysis results in memory for later access.