Enhanced Skype Traffic Identification

Abstract

Skype applies strong encryption to provide secure communication inside the whole Skype network. The communication ports of clients are chosen randomly. As a consequence, traditional port based or payload based identification of Skype traffic cannot be applied. In this paper we present a novel flow dynamics based identification method to discover both Skype hosts and voice calls. The method is based only on packet headers and extracted flow level information. This method is the second algorithm from our research. It has a significant improvement over our first method [1]. It can detect the randomly selected communication port of the Skype client, which makes the identification more reliable. The whole identification process is scripted in Transact-SQL, thus it can be executed automatically. We also present the validation of the new algorithm together with the analysis of the identification results.

Characterizing per-application network traffic using entropy

“…From previous research on Skype traffic identification [Perényi and Molnár 2007;Rossi et al 2008], we know that we can expect to find patterns (and thus a high degree of predictability) in Skype audio flows. From the cumulative distribution function (CDF) of the packet interarrival times in Figure 1(a), we can see that there are 4 distinct interarrival times in Skype VoIP flows.…”

Threshold-based generic scheme for encrypted and tunneled Voice Flows Detection over IP Networks

“…Many researches (Leung and Chan, 2007;Baset and Schulzrinne, 2006;Lu et al, 2010;Peranyi and Molnar, 2007) have been done for detecting Skype traffic by pattern analysis. By investigating Skype, the paper (Leung and Chan, 2007) discuss 15 basic stages of Skype communication from start to end such as start up, registration, etc.…”

Traffic analysis attacks on Skype VoIP calls

“…and dynamic path selection I (1.2). and the constant packet rate [5). To further protect privacy of Skype VolP calls.…”

“…(d) Skype calls are encrypted and hard to decipher [3]. (e) Skype sends packets at the constant rate of 33 packet/s [5]. Due to the un ique set of features listed above, Skype is known as secure voice communication [3] which can protect privacy of communication parties.…”

“…(b) During silent periods, VoIP packets generated by Skype are small in comparison with packets generated during talk periods. We do not focus on packet timing information in this paper mainly because Skype cli ents send VoIP packets at a constant rate [5]. sum of bytes received or sent during the ith sample interval…”