Research On Technology For Identification Of VoIP Gateways

With the un-limits platform provided by the technology of voice-processing maturely and the openness of Internet, VoIP(Voice over IP)develops rapidly. At the same time, there are many lawless and hidden VoIP gateways which bring negative impact to the telecom network, and provide convenient passages to the spread of deleterious messages. so it is urgent to detect these illegitimate gateways and inspect VoIP traffic. To escape from the inspection, lawless gateways often adopt non-standard ports and private protocols to communicate, so the common technology based on detecting ports can not performs well.This dissertation supported by the National High-Tech Research and Development Program of China (863) carries on a deep research on the technology of VoIP. The idiographic work of this dissertation focuses on two aspects:⑴Identify signaling gateways by statistic of IP addresses, utilizing the text characteristic of signaling message and concentricity of flows from the same source IP address;⑵Identify media gateways by statistic of mean inter-arrival time of packets which come from the same IP address, according to the relationship between inter-arrival time of media packets and interval-sending time of packets at media gateways. Main work and contributions of this dissertation are outlined as follows:A strings matching algorithm based on segment matching is proposed, which is short for SM algorithm. This algorithm divides text by especial characters, then strings matching is made between the divided text and optimized patterns saved in sets. The correlation of content existing in strings and patterns requires no consideration in the SM algorithm which has steady time consumption. The result of experiment indicates that the SM algorithm performs better than BM algorithm in single pattern matching when the pattern is short and better than the Wu-Manber algorithm in the multi-pattern matching. After identification of signaling message with strings matching algorithm, a method to identify signaling gateways is proposed by statistic of source IP address based on concentricity.A hash algorithm short for SC-XOR is proposed, which produces a random cluster of 16 bits derived from five-tuple. The algorithm makes use of the different frequency of diversification between higher bytes and lower bytes of IP address and port. The SC-XOR algorithm improves the XOR-SHIFT because of symmetry cross XOR operation to bytes of five-tuple.A method to identify media gateways is proposed, which is based on statistical flow characteristic. This method regards interval-arrival time as characteristic, then computes mean interval-arrival time in single flow and makes statistic calculation among flows which have the same source IP address. Finally, media gateways can be confirmed by comparison of the peak value of statiscal mean interval-arrival time and interval-sending time of packets at media gateways.A system to inspect VoIP traffic based on identification of gateways is designed. This system includes following parts: to complete filtration of packets, identification of gateways, disposal of data , management of system, et al. This system could find out lawless gateways hiding in Internet. Moreover, IP addresses can be feeded back to the part to filtrate packets, which will improve capability of system to deal with packets greatly.