Multistage SPIT detection in transit VoIP

Spam in telephony refers to unsolicited, automatically dialed, pre-recorded phone calls often used for marketing or phishing. Spam in telephony can affect the productivity of human beings and deprive legitimate users of phone network resources. Spam over Internet Telephony (SPIT) is a challenge and can become a major threat when telephony completely shifts to VoIP. Email anti-Spam techniques are typically not applicable to SPIT detection: SPIT detection needs to be near real-time; call content is not available for processing before the call is established; there are only a small number of features available for examination; and signaling messages of spammer and non-spammer are similar. SPIT detection in transit VoIP operator is a non-trivial task because of the high call volume and the unavailability of direct interaction with a caller or a callee. In this paper we present a multistage SPIT detection framework that addresses these issues. Our framework blocks SPIT based on the social relationships and statistical features of the caller. The framework consists of three modules: a blacklist, a statistical module, and a trust module. For achieving better results and resource optimization, we provide feedback on where these modules should be placed in the transit network. Our experimental results show that the detection response time increases slightly after system deployment, but this increase is not noticeable to the callers. Besides SPIT detection the framework can also detect flooding, vishing and number scan attacks.