VoIP Traffic Identification Based On Symmetry And Segmentation Statistical Characteristic

VoIP has been bringing a great impact to the people's work and life since it appears. It relies on existing Internet and the environment of global IP interconnection, providing servers more convenient and more inexpensive than traditional communications. The users of VoIP can communicate with the people not only using VoIP but also traditional telephone. It is harder to manage and control VoIP than PSTN.The rapid development of VoIP increases question of network security and make it harder to manage network when it bring convenience. It goes without saying the importance of VoIP traffic identification which is the basis of VoIP management and control. With the rapid development of the network and dramatically increascent of network services, the environment of network becomes more complex, traditional traffic identification methods can't identify VoIP exactly. Therefore, a lot of methods for VoIP traffic identification have been suggested.This thesis introduces some protocol and technology simply about VoIP, then depicts usual netflow identify methods and the ways of VoIP traffic identification, especially describes the method called Skype Traffic Identification Base on Statistical Characteristic. On the basis of studying the existing methods of VoIP traffic identification, this thesis proposes a method that is VoIP Traffic Identification Based on Symmetry and Segmentation Statistical Characteristic.By analyzing the symmetry, the average packet interval time gap and the segmentation statistical characteristic of packet length, the method can identify VoIP traffic. A system base on this method came true in this thesis, it can identify VoIP traffic which use SIP or H.323 as signaling protocol by learning characteristic from definite traffic, as expected,Skype traffic also can been identified. These systems without requiring deep packet inspection and the universal property are more excellent than other VoIP traffic identify methods.Through the experiment of identifying popular VoIP such as Skype, NETMEETING, MSN, QQ, the system has higher real-time performance, low false positive rate and low false negative rate, and it can identifies VoIP traffic speedy and accurately .