Voice over IP

I n general, “spam” describes information, often dubious in nature, sent to numerous recipients without their prior consent. Although the term typically refers to emails about hot stocks, revolutionary medicine, or adult content, spam can apply to all kinds of messages. Examples range from telemarketing calls and short message service texts to bulk mail and faxes. Since the first incident in the early ’90s, Internet spam has increased significantly. Of all exchanged mail, spam’s portion has risen from less than 10 percent in 2001 to more than 80 percent today, according to statistics from antispam organizations such as Spam-O-Meter.com. Session Initiation Protocol (SIP) has established itself as the de facto standard for voice-over IP (VoIP) services in fixed and mobile environments. From a technological viewpoint, SIP-based VoIP services show a greater resemblance to email than to traditional telephony systems. Hence, with SIP services gaining in popularity, spammers likely will misuse services as they do email—a practice known as spam over Internet telephony (SPIT). This probable exponential increase in spam requires mitigating SPIT in its early stages. Solutions are even more critical because of SPIT’s threat to users’ trust in VoIP in general. Lack of confidence in secure and trusted infrastructures would slow down VoIP adoption. Our solution framework combines well-known detection schemes, such as blacklists and white lists, with methods based on statistical traffic analysis, such as the number and duration of calls a user conducts. (For more on existing detection schemes, see the “Related Work in Fighting VoIP Spam” sidebar on p. 57.) The SPIT Detection and Reaction System (SDRS) also takes into account users’ and operators’ preferences.