VoIP Traffic Analysis via Netflow V9 URI Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing VoIP traffic analysis tools struggle to accurately analyze VoIP traffic in NAT environments due to their inability to utilize additional information such as transmitter URI, receiver URI, and media session identification, limiting their ability to detect abnormal attacks effectively.
Innovation Solution
A statistical information generator for VoIP traffic analysis that collects packets from a network, analyzes call setup and media packets, and generates statistical information using transmitter identification, receiver identification, and call/media session identification as key values, enabling the creation of Netflow V9-compatible data for comprehensive traffic analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing generators use only 5-tuple information for netflow generation, then device complexity is reduced and ease of operation is improved, but measurement precision and reliability of VoIP traffic analysis deteriorate
Solution Approach 1:
The generator is divided into distinct modules: a packet collection module that gathers packets from the network, and a statistical information generation module that processes packets. This segmentation allows each module to specialize in specific tasks, improving VoIP analysis accuracy while managing complexity through modular design.
Solution Approach 2:
The system transitions from traditional 5-tuple netflow (source IP, destination IP, source port, destination port, protocol) to Netflow V9 by adding dimensional information including URI (Uniform Resource Identifier) and media session identification. This dimensional expansion enables precise VoIP traffic analysis by capturing application-layer information that was previously unavailable.
2Reliability
If additional information such as URI and media session identification is collected, then measurement precision and reliability of VoIP analysis are improved, but device complexity and information processing requirements increase
Solution Approach 1:
The statistical information generation module pre-processes collected packets to extract and organize relevant information including URI and media session identification before generating netflow. This preliminary action ensures that all necessary information is prepared in advance, improving analysis reliability while managing processing complexity through structured pre-processing.
Solution Approach 2:
The statistical information generation module acts as an intermediary between packet collection and netflow generation. It receives raw packets, extracts relevant information including URI and media session data, and transforms this into structured statistical information suitable for VoIP analysis, thereby improving reliability while managing complexity through intermediate processing.
3Adaptability or versatility
If traditional 5-tuple netflow is used, then ease of operation and compatibility are maintained, but adaptability to NAT environments and VoIP-specific analysis capabilities are reduced
Solution Approach 1:
The generator is designed to support multiple netflow versions including traditional 5-tuple netflow and Netflow V9. This multi-functionality allows the system to adapt to different network environments including NAT scenarios while maintaining operational simplicity through a unified interface that automatically selects the appropriate netflow format.
Solution Approach 2:
The system dynamically changes netflow parameters based on the analysis requirements and network environment. When NAT environments or VoIP traffic are detected, the generator automatically switches to Netflow V9 format with enhanced parameters including URI and media session identification, thereby improving adaptability while maintaining ease of operation through automatic parameter selection.
Data Source
AI summary
A statistical information generator for VoIP traffic analysis is provided, which comprises a packet collection module collecting packets from a network; and a statistical information generation module analyzing information of a call setup packet or a media packet among the packets collected by the packet collection module, and generating statistical information of the network; wherein if the packet collected by the packet collection module is the call setup packet, the statistical information generation module generates the statistical information of the network using at least one of transmitter identification information, receiver identification information, and call identification information among information of the call setup packet as a key value, while if the packet collected by the packet collection module is the media packet, the statistical information generation module generates the statistical information of the network using media session identification information among information of the media packet as a key value.