Fingerprints in the spectrum: Spectral analysis and detection of VoIP traffic

We propose a novel Voice over IP (VoIP) traffic detection approach which can penetrate some important barriers in front of common traffic identification mechanisms: encryption, complexity and camouflage. First we use the information source, channel and destination model in the communication theory to reexamine our understanding of Internet data flows. The packet, the Inter Arrival Time (IAT) between 2 successive packets and the payload length which are only of statistical meanings previously, are now assigned physical properties as pulse, pulse arrival time and the amplitude. The packet-based Internet traffic is therefore transformed to a discrete-time pulse sequence. We then use spectral analysis to exhibit frequency domain behaviors of the general Internet background traffic and some typical VoIP traffics. The result reveals that all kinds of VoIP traffics have their own characteristics (i.e., peaks in certain frequencies) on the power spectrum. Experimental data on simulation as well as real life data set indicates that the approach is effective on recognizing VoIP traffics. We argue that the novel approach complements existing traffic identification mechanisms. The rationale behind it can also be applied to other fields.