The DOI matches its Crossref record; 10 of the 11 references it cites were found in a registry or an index.
Revealing skype traffic: when randomness plays with you
Abstract
Skype is a very popular VoIP software which has recently attracted the attention of the research community and network operators. Following a closed source and proprietary design, Skype protocols and algorithms are unknown. Moreover, strong encryption mechanisms are adopted by Skype, making it very difficult to even glimpse its presence from a traffic aggregate. In this paper, we propose a framework based on two complementary techniques to reveal Skypetraffic in real time. The first approach, based on Pearson'sChi-Square test and agnostic to VoIP-related trafficcharacteristics, is used to detect Skype's fingerprint from the packet framing structure, exploiting the randomness introduced at the bit level by the encryption process. Conversely, the second approach is based on a stochastic characterization of Skype traffic in terms of packet arrival rate and packet length, which are used as features of a decision process based on Naive Bayesian Classifiers.In order to assess the effectiveness of the above techniques, we develop an off-line cross-checking heuristic based on deep-packet inspection and flow correlation, which is interesting per se. This heuristic allows us to quantify the amount of false negatives and false positives gathered by means of the two proposed approaches: results obtained from measurements in different networks show that the technique is very effective in identifying Skype traffic. While both Bayesian classifier and packet inspection techniques are commonly used, the idea of leveraging on randomness to reveal traffic is novel. We adopt this to identify Skype traffic, but the same methodology can be applied to other classification problems as well.
Overview
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“Bonfiglio et al. [69] perform controlled experiments to reverse engineer the structure of Skype messages between two Skype clients (E2E) and between a Skype client and a traditional PSTN phone (E2O).”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [69]
In the citing paper
“However, higher FNs are noticeable in comparison to the isolated classifiers, as the combination disregards video and data transfers, and correctly identify only those Skype flows that actually carry voice traffic.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [69]
In the citing paper
“In the evaluation, the NB classifier is effective in identifying all voice traffic, while the χ 2 classifier accurately identifies all Skype traffic over UDP and all encrypted or compressed traffic over TCP.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [69]
In the citing paper
“Jointly, NB and χ 2 classifier outperform the classifiers in isolation by detecting Skype voice traffic over UDP and TCP with nearly zero FP.”
From A comprehensive survey on machine learning for networking: Evolution, applications and research opportunities (2018) · cites this paper as [69]
Citations
Cites
RTP: A Transport Protocol for Real-Time Applications
Schulzrinne, H. G., Casner, S. L., Frederick, R., & Jacobson, V. L. (2003) · doi:10.17487/rfc3550 · Cited by 5,779
An Analysis of the Skype Peer-to-Peer Internet Telephony Protocol
Baset, S., & Schulzrinne, H. G. (2006) · doi:10.1109/infocom.2006.312 · Cited by 736
Carson, M., & Santay, D. J. (2003) · ACM SIGCOMM Computer Communication Review · doi:10.1145/956993.957007 · Cited by 489
Internet traffic classification using bayesian analysis techniques
Moore, A. W., & Zuev, D. (2005) · ACM SIGMETRICS Performance Evaluation Review · doi:10.1145/1071690.1064220 · Cited by 460
An Experimental Study of the Skype Peer-to-Peer VoIP System
Guha, S., & Daswani, N. (2005) · eCommons (Cornell University) · Cited by 405
Rescorla, E. (2000) · doi:10.17487/rfc2818 · Cited by 265
Quantifying Skype user satisfaction
Chen, K.-T., Huang, C., Polly Huang, B., & Lei, C. (2006) · ACM SIGCOMM Conference (SIGCOMM) · doi:10.1145/1159913.1159959 · Cited by 120
Biondi, P., & Desclaux, F. (2006) · Cited by 107
Measuring IP and TCP behavior on edge nodes with Tstat
Mellia, M., Cigno, R. L., & Neri, F. (2004) · Computer Networks · doi:10.1016/j.comnet.2004.06.026 · Cited by 86
Self-citationThe Secure Shell (SSH) Protocol Assigned Numbers
Lehtinen, S. (2006) · doi:10.17487/rfc4250 · Cited by 40
Research works printed but not linked: 2
- K. Suh , D. R. Figuieredo , J. Kurose , D. Towsley , "Characterizing and detecting relayed traffic: A case study using Skype ", IEEE Infocom'06 , Barcelona, Spain , Apr. 2006 . K. Suh, D. R. Figuieredo, J. Kurose, D. Towsley, "Characterizing and detecting relayed traffic: A case study using Skype", IEEE Infocom'06, Barcelona, Spain, Apr. 2006.
- D. S. Sivia , "Data Analysis : A Bayesian Tutorial ". Oxford University Press , Sep. 1996 . D. S. Sivia, "Data Analysis: A Bayesian Tutorial". Oxford University Press, Sep. 1996.
Cited by
Sorted by citations
Boutaba, R., Salahuddin, M. A., Limam, N., Ayoubi, S., Shahriar, N., Estrada-Solano, F., & Caicedo, O. M. (2018) · Journal of Internet Services and Applications · doi:10.1186/s13174-018-0087-2 · Cited by 1,036
Classifying IoT Devices in Smart Environments Using Network Traffic Characteristics
Sivanathan, A., Gharakheili, H. H., Loi, F., Radford, A., Wijenayake, C. A., Vishwanath, A., & Sivaraman, V. (2018) · IEEE Transactions on Mobile Computing · doi:10.1109/tmc.2018.2866249 · Cited by 812
Robust Network Traffic Classification
Zhang, J., Chen, X., Xiang, Y., Zhou, W., & Wu, J. (2015) · IEEE/ACM Transactions on Networking · doi:10.1109/tnet.2014.2320577 · Cited by 391
Shen, M., Wei, M., Zhu, L., & Wang, M. (2017) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2017.2692682 · Cited by 200
Can encrypted traffic be identified without port numbers, IP addresses and payload inspection?
Alshammari, R., & Zincir-Heywood, N. (2010) · Computer Networks · doi:10.1016/j.comnet.2010.12.002 · Cited by 153
Metadata
- Authors
- Bonfiglio, D., Mellia, M., Meo, M., Rossi, D., & Tofanelli, P.
- Affiliations
- Politecnico di Torino (IT)
- Télécom Paris (FR)
- Motorola (Italy) (IT)
- Venue
- ACM SIGCOMM Computer Communication Review
- Published
- 2007-08-27
- Volume
- 37
- Issue
- 4
- Pages
- 37-48
- ISSN
- 0146-4833 (ISSN-L)
- OpenAlex
- W3160447194
- Cited by
- 112
- References
- 11
- Citations by year
- 2026: 1 · 2024: 2 · 2022: 8 · 2021: 6 · 2020: 4 · 2019: 3 · 2018: 7 · 2017: 7 · 2016: 10 · 2015: 7 · 2014: 11 · 2013: 11 · 2012: 6
- FWCI
- 7.89
- Type
- journal article
- Language
- en
- Open access
- closed
- Locations
- ACM SIGCOMM Computer Communication Review (publishedVersion)
- PORTO@Iris (submittedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Traffic and Congestion Control
- Keywords
- Pearson chi-square test, packet arrival rate, packet size, naive Bayesian classifier, deep packet inspection, flow correlation
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
