An anomaly-based approach to the analysis of the social behavior of VoIP users

Abstract

In this paper we present the results of a study we recently conducted by analyzing a large data set of VoIP Call Detail Records (CDRs), provided by an Italian telecom operator. The objectives of this study were twofold: (i) first, to provide a representation of users behavior, as well as of their mutual interaction and communication patterns, allowing to identify certain easily separable user categories; and (ii) second, to design and implement a framework calculating such a representation starting from CDR, capable of operating within certain time constraints, and grouping users using unsupervised techniques.

The paper shows how we can reliably identify behavioral patterns associated with the most common anomalous behaviors of VoIP users. It also exploits the expressive power of relational graphs in order to both validate the results of the unsupervised analysis and ease their interpretation by human operators.

Introduction

The foundation of the work described in this paper consists of the definition of a behavioral model for profiling users of a commercial VoIP (Voice over IP) service. The user profile consists of a set of user-related information, including identifiers, characteristics, preferences, as well as data related to activities that are relevant to understand and predict the user’s behavior in a certain domain.

User profiling is the continuous process of creating, maintaining and updating user profiles aimed at exploiting them in different fields, e.g., marketing, provisioning of targeted services, performing of optimization tasks of various kinds.

As part of the profiling activity, clustering and segmentation of customers can ease the task of understanding what are the main emerging behavioral attitudes the service provider has to meet.

These considerations also hold for VoIP network and service providers.

In this field, it is very useful for telecom operators to gain knowledge about both global information regarding VoIP usage (e.g., in order to manage resource deployment) and more fine-grained details about users’ habits (e.g., in order to design tailored value added ICT services). Moreover, user profiling can be profitably exploited for monitoring and protecting the security of VoIP platforms. As a matter of fact, several types of VoIP threats consist of malicious users (either human agents or automatic tools) issuing unsolicited and unwanted calls towards legitimate VoIP customers with the purpose of telemarketing, making frauds, or, to some extent, causing denial of service. Indeed, a high number of unsolicited calls targeting legitimate users, in addition to raising the customers’ dissatisfaction with respect to the negotiated service level, can even result in network faults and service blocks. Literature refers to such kind of attacks as “social threats”, due to the direct contact the attacker establishes with the victim and to the exploitation of the “social” implications of the usage of VoIP.

In this paper we aim to show how it is possible to capture different families of VoIP-callers behaviors by means of a profiling system based on a well-designed user behavior model. In particular, we show how we succeed in isolating anomalous behaviors that can be potentially malicious and that are then worth to be paid attention by the security manager. The study is conducted on real-world data, in the form of VoIP Call Detail Records (CDRs), made available to us by an Italian telecom operator in the framework of a sponsored research project called CAST (Countering Attacks and Social Threats in VoIP Networks). The profiling system we herein describe has been developed in the context of such a project, so we will refer to it as to the CAST system.

The rest of the paper is structured as follows. In Section 2 we present a brief taxonomy of the most well-known security threats currently affecting VoIP networks, with a focus on social threats. In Section 3 we will present the current state of the art in the field of VoIP security, with an eye on the most interesting proposals related to social attacks detection. Section 4 presents an overview of the CAST architecture.

The main details associated with its implementation are provided in Section 5, whereas Section 6 illustrates the results we obtained by applying the CAST profiler to the analysis of the real data about VoIP calls which were made available to us. As a further contribution to the analysis, we also provide in Section 7 more information about the application of the theory of social graphs to the analyzed data set. Finally, Section 8 summarizes the main results of our current efforts and indicates the most interesting directions of our future work.