Phoneypot: Data-driven Understanding of Telephony Threats

Abstract

Cyber criminals are increasingly using robocalling, voice phishing and caller ID spoofing to craft attacks that are being used to scam unsuspecting users who have traditionally trusted the telephone. It is necessary to better understand telephony threats to effectively combat them. Although there exist crowd sourced complaint datasets about telephony abuse, such complaints are often filed after a user receives multiple calls over a period of time, and sometimes they lack important information. We believe honeypot technologies can be used to augment telephony abuse intelligence and improve its quality. However, a telephony honeypot presents several new challenges that do not arise in other traditional honeypot settings. We present Phoneypot, a first large scale telephony honeypot, that allowed us to explore ways to address these challenges. By presenting a concrete implementation of Phoneypot using a cloud infrastructure and 39,696 phone numbers (phoneytokens), we provide evidence of the benefits of telephony honeypots. Phoneypot received 1.3 million calls from 250K unique sources over a period of seven weeks. We detected several debt collectors and telemarketers calling patterns and an instance of a telephony denial-of-service attack. This provides us with new insights into telephony abuse and attack patterns. Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment.

A Machine Learning Approach to Prevent Malicious Calls over Telephony Networks

“…Similarly, the two other lines are drawn by considering incoming calls of TouchPal users and all benign users. From the figure, we observe a long tail distribution, which is consistent with earlier reports using a [15]. However, we observe that the tails of malicious call numbers and TouchPal users are significantly higher than benign phone numbers.…”

“…We attribute this to the fact that only less than 700 call records are collected in [9], and thus the results in [9] may not be statistically robust. On the other hand, similar observations have been made based on US's data [15], though some details are different. For example, the hourly call volume histogram from [15] looks more similar to Figure 4a All above observations suggest that the call time may be a useful indicator to distinguish malicious calls from benign ones.…”

“…There have been a variety of systematic studies in malicious call analysis. For example, [15] builds a honeypot with 39,696 phone numbers that are abandoned because former owners received too many unwanted calls. The incoming calls to these phone numbers are treated as malicious calls and analyzed.…”

“…Using this dataset, we conduct a large scale measurement study to understand which information is more helpful to distinguish malicious calls from benign ones. Note that there have been several prior work providing measurement studies [15], [22]. However, these work mainly focused on malicious call records, and did not provide insights on how malicious call records differ from benign ones.…”

On Security Research Towards Future Mobile Network Generations

“…There are surveys on mobile applications such as secure messaging systems [12] and mobile operating systems, e. g., Android [13]. On the other hand, there are generic Internet security surveys [14] and telephony security contributions focusing on fraud attacks [15], [16], [17].…”