CERIAS Tech Report Spam Detection in Voice-over-IP Calls through Semi-Supervised Clustering by Yu-Sung Wu, Saurabh Bagchi, Navjot Singh,

Transcription

1 CERIAS Tec Report 9-3 Spam Detecton n Voce-over-IP Calls troug Sem-Supervsed Clusterng by Yu-Sung Wu, Saurab Bagc, Navjot Sng, Ratsameetp Wta Center for Educaton and Researc Informaton Assurance and Securty Purdue Unversty, West Lafayette, IN

2 Spam Detecton n Voce-over-IP Calls troug Sem- Supervsed Clusterng Yu-Sung Wu, Navjot Sng Ratsameetp Wta 3 Saurab Bagc Scool of Electrcal & Computer Eng., Purdue Unversty, West Lafayette, IN 4797 Avaya Labs, 33 Mt. Ary Rd., Baskng Rdge, NJ 79 3 Culalongkorn Unversty, Taland {yswu,sbagc@purdue.edu, sng@avaya.com, Ratsameetp.W@Student.cula.ac.t ABSTRACT In ts paper, we present an approac for detecton of spam calls over IP telepony called SPIT n Voce-over-IP (VoIP) systems. SPIT detecton s dfferent from spam detecton n emal n tat te process as to be soft real-tme, fewer features are avalable for examnaton due to te dffculty of mnng voce traffc at runtme, and smlarty n sgnalng traffc between legtmate and malcous callers. Our approac dffers from exstng work n ts adaptablty to new envronments wtout te need for laborous and error-prone manual parameter confguraton. We use clusterng based on te call parameters leveragng optonal user feedback for some calls, wc tey mark as SPIT or non-spit. We mprove on a popular algortm for sem-supervsed learnng, called MPC-Means, to make t scalable to a large number of calls. Our evaluaton on captured call traces sows a ffteen fold reducton n computaton tme, wt mprovement n detecton accuracy. eywords Voce-over-IP systems, spam detecton, spt detecton, semsupervsed learnng, clusterng. INTRODUCTION As te popularty of VoIP systems ncreases, tey are beng subjected to dfferent knds of securty treats []. A large class of te treats suc as call reroutng, toll fraud, and conversaton jackng ncur devatons n te protocol state macnes and can be detected troug montorng te protocol state transtons [],[3]. Addtonally, cryptograpcally secure versons of te common VoIP protocols, suc as Secure SIP and Secure RTP, address many of te attacks presented n te lterature. However, spam calls n VoIP [4], commonly called SPIT, are becomng an ncreasng nusance. Te ease wt wc automated SPIT calls can be launced can deral te adopton of VoIP as a crtcal nfrastructure element. Exstng montorng and cryptograpc solutons are not mmedately applcable to SPIT detecton. In ts paper, we address te problem of detecton of SPIT calls. Detecton of spam emals s a mature feld and tere are some smlartes to our problem. In bot domans, users can provde feedback about ndvdual emal or call, often troug a bult-n button n commercally avalable VoIP pones. However, tere exst sgnfcant dfferences VoIP traffc s real-tme and te detecton sould deally be real-tme as well, some features are expensve to extract n real-tme, specfcally tose n te voce meda traffc, te sgnalng patterns are lkely smlar n legtmate and malcous calls renderng content-based flterng on sgnalng traffc neffectve, and features from multple protocols used n VoIP may be relevant. In ts paper, we present te desgn of a system tat uses semsupervsed macne learnng for detecton of SPIT calls. It bulds on te noton of clusterng wereby calls wt smlar features are placed n a cluster for SPIT or legtmate calls. Call features nclude tose extracted drectly from sgnalng traffc suc as te source and destnaton addresses, extracted from meda traffc, suc as proporton of slence, and derved from calls, suc as duraton and frequency of calls. Approaces tat use tresolds [5] on te call features are dffcult to use n practce snce te nature of SPIT calls vares wdely. Te popular sem-supervsed clusterng algortm called MPC-Means [6] scales as O(N 3 ) were N s te number of calls. Ts would generally be too expensve for real-tme operaton. We modfy ts to create our algortm called empc-means, usng VoIP specfc features to reduce t to O(N). Suc specalzaton ncludes te early use of user feedback and pror knowledge of te number of clusters. Addtonally, we create an ncremental protocol called pmpc-means, tat can perform te detecton as soon as te call s establsed provdng te opton of automatcally angng up a suspect call. We evaluate te protocols usng four call traces wt dfferent caracterstcs of SPIT and non-spit calls, over dfferent proportons of user feedback and accuracy of te user feedback. Wt a batc of 4 calls, empc-means s 5 tmes faster tan MPC-Means, wle acevng better detecton coverage n terms of true and false postves. Snce pmpc-means can examne a lmted set of call features, t works well only wt a large fracton of calls wt accurate user feedback.. RELATED WOR Rosenberg [4] detals te problem of VoIP SPIT and gves varous g-level conceptual solutons. Te solutons can be placed n tree categores [7]: () Non-ntrusve metods based on te excange and analyss of sgnalng messages; () Interacton metods tat create nconvenences for te caller by requestng er to pass a ceckng procedure before te call s establsed; (3) Callee nteracton metods tat excange nformaton wt te callee on eac call. An example work n category s [8] were te autors look at te SIP sgnalng traffc pattern to detect SPIT. However, tey do not provde quanttatve data on te detecton accuracy. Our expermental results ndcate solely relyng on SIP message patterns wll gve low detecton coverage. Te work by Quttek [7] generates a greetng sound or faked rng tone to te caller rgt after te call s establsed and montors te response voce patterns from te caller to dfferentate between uman

3 caller and a SPIT generator. Ts falls n category. In comparson, our work encompasses categores and 3. olan [9] presents an approac based on trust, reputaton, and socal networkng. Tey mantan te trust nformaton for eac caller, wc can be automatcally bult up troug user feedback, or troug a propagaton of reputaton va socal networks. Ter approac can be used wt our work n wc we can embed te caller s trust as one of te dmensons n our call data ponts. A dstncton between ter work and ours s tat ter approac s ted wt eac caller, wle our approac looks at eac pone call drectly. Te sze of te reputaton database may grow large and a reputaton system can be gamed by false prase or false negatve ratngs. For spam detecton n emal, te famly of Nave Bayes (NB) classfers [],[] s probably one of te most commonly mplemented. Tey extract keywords and oter ndcators from emal messages and determne weter te messages are spam usng some statstcal or eurstc sceme. However, spammers nowadays are usng ncreasngly sopstcated tecnques to trck content-based flters by clever manpulaton of te spam content, leadng to a vrtual arms race. Recent work [],[3] as used features for te senders extracted from socal networks n supervsed learnng or n creatng wte/blacklsts. Supervsed learnng reles on a tranng pase wt accurate tranng data, wle our approac does not. Clusterng s a way to learn a classfcaton from te data [4], especally wt unlabelled data. Clusterng tecnques ave been used on detectng e-mal spam by [5] and [6]. On te oter and, classfcaton tecnques suc as SVM[7] s a popular approac for dong data classfcaton. However, tey typcally requre labeled data and doesn t take unlabelled data nto consderaton. Recent development on sem-supervsed classfcaton tecnques [8] suc as sem-supervsed SVM[9] addresses ts. 3. DESIGN 3. Structure of VoIP calls A. Call Establsment B. Meda Stream (RTP/RTCP) / Call Mantenance C. Call Tear Down Fgure. Tree pases n a VoIP call Fgure sows te typcal tree pases nvolved n a VoIP pone call []. Te frst pase s call establsment troug a tree-way andsake, wc nvolves te caller sendng SIP INVITE messages to te proxy server, te server forwardng te INVITE message to te callee, te callee replyng wt SIP O message, and eventually SIP AC message to complete te call establsment pase. Te second pase s te conversaton, wc contans te meda stream (voce) transmtted between te caller and te callee typcally usng RTP/RTCP []. Te last pase s te call tear down pase, wc can be ntated by eter te caller or te callee sendng SIP BYE messages followed by SIP O and SIP AC messages. 3. Caracterstcs of VoIP SPIT calls In ts secton, we elaborate on te dfferent patterns one can perceve between SPIT and non-spit calls. 3.. Look at eac ndvdual call Wen lookng at eac ndvdual call, bot SPIT and non-spit calls follow te same tree pases descrbed n Sec. 3.. From te call establsment pase, te only possble dfferences one can really tell s te source IP and te From URI n te SIP INVITE (te pone number of te caller/sptter). Tere may be dfferences n te User-Agent feld and te SDP part n te SIP INVITE f te pones used by te sptter are of a dfferent model tan te ones used by legtmate users. However, ts s a dubous caracterstc to base te determnaton on. In general, one can only resort to a blacklst-based approac to dstngus between SPIT calls and non-spit calls wen lookng at te call establsment pase. In te meda stream pase, a typcal pattern one can magne for SPIT calls s tat te caller tends to speak more tan te callee. Anoter pattern s tat te lengt of te meda stream pase,.e., te call duraton, could be sorter n te case of calls answered by a lve person snce SPIT calls are generally undesrable. Te call tear down pase nvolves te same SIP BYE/O/AC messages for SPIT and non-spit calls. A possble dfference toug s wc of te two partes angs up te call frst, wc translates to wc sde sends te SIP BYE message. Assumng SPIT calls are undesrable, one can assume tat t s more lkely tat a call wll be ung up by te callee. Ts mode of lookng at ndvdual calls would be useful to an ndvdual consumer wo would be elped by a SPIT call beng dropped wtout er avng to pck up te call. Te callenge ere s wat would be te approprate tresold values on te dfferent call features to determne f a call s SPIT or not. We beleve tat due to te dversty of SPIT calls, t s dangerous to use statc tresolds for any of te call features. Ts prompted us to explore more dynamc scemes tat automatcally adapt to cangng call patterns. 3.. Look at te wole batc Snce SPIT calls are usually large volume calls made by some sptter wtn a perod of tme, we found tat t s also useful to look for te correspondng pattern n a batc of calls. Certan features are avalable wen lookng at te collectve set of calls. Tese nclude te nter-arrval tme between calls, te densty of calls, etc. Ts mode would be useful say to a servce provder tat s nterested n dentfyng and blacklstng sources of SPIT calls n ts networks. 3.3 Te detecton sceme A VoIP envronment typcally conssts of multple domans wt eac doman composed of a few proxy servers and pones belongng to end users. Te pones can be soft pones (a general purpose computer wt approprate software) or ard pones (ardware for makng and recevng VoIP calls). Te two domnant sgnalng protocols used n VoIP are H.33 and SIP, wt te latter becomng ncreasngly domnant. Fgure sows an example VoIP envronment consstng of two domans. In a VoIP envronment, a proxy server s man functon s to route te sgnalng messages. For te specfc example we sow, ere Proxy # s used to route te sgnalng messages among pones {A,B,C. And smlarly, Proxy # s used to route te sgnalng messages among pones {E,F. Cross doman pone calls

4 {A,B,C {E,F are collaboratvely andled by Proxy # and Proxy #. Once a pone call s establsed, subsequent sgnalng messages can possbly travel drectly between pones not va te proxes. However, an ISP can mandate all sgnalng traffc troug te proxes, wc s usually te case for bllng/securty purposes. Legend S Te meda streams followng call establsment are usually transmtted drectly between te pones suc tat te workload on te server can be reduced. However, t s also possble to let te servers proxy te meda streams as well. Ts s used wen transcodng of te meda stream s requred (e.g. te two pones do not use te same codec.) and for securty and accountng purposes. Our approac n detectng SPIT calls nvolves placng local detectors at te SIP Proxy and te pones n te managed doman. Essentally, te detectors observe te sgnalng and meda streams wtn te doman no matter tey are proxed or sent drectly from end to end. Te domans tat ave our detecton mecansm are called managed domans and oters are called unmanaged domans. We assume a sptter can exst as any pone n a VoIP envronment, weter wtn a managed (pone B) or an unmanaged doman (pone E). New pone call detected A Early Detecton (before meda stream s establsed) A3 : normal user : sptter SIP based VoIP Proxy Server # Clent -sde Detector B Annotate pone call B wt optonal Collecton of B3 user feedback nformaton all detected pone calls A Server -sde Detector Clent -sde Detector S Spt Detector Clent -sde Detector A B C Clusters of spt calls. SIP based VoIP Proxy Server # S Fgure 3. Detectng Spt Calls n a VoIP Envronment B4 E F Semsupervsed clusterng Te detectors embedded at te server and te pones collect te nformaton of te pone calls and send tem to te SPITDetector, wc s te place were te logc on dfferentatng SPIT calls from non-spit calls executes. Te nformaton about a pone call may nclude From URI (caller dentty), To URI (callee dentty), slence duraton n te RTP meda streams, etc. Snce te decodng of tese nformaton are andled by te respectve server-sde/clent-sde detectors and only a dgest of te necessary nformaton s forwarded up to te SPITDetector, network traffc s mnmzed. If scalablty becomes an ssue, we can dvde a doman nto sub-domans and ave separate SPITDetectors perform detecton for pone calls wtn eac sub-doman concurrently. User feedback about calls can be sared between te sub-domans wtn one doman. Our approac accommodates ncremental deployment n tat clents n managed domans wll ave detecton of SPIT calls, weter tey orgnate from managed or unmanaged domans. Essentally, our problem s a data classfcaton problem, were we want to classfy pone calls nto SPIT calls and non- SPIT calls. In te SPITDetector, we employ a sem-supervsed clusterng tecnque, wc s one of te recent data classfcaton approaces []. Fgure sows te process flow nvolved n te SPITDetector, wc supports two modes of detecton: Mode A: Look at eac pone call wt early detecton In ts mode, te SPITDetector as to determne weter a call s a SPIT or not before te meda stream of te call s establsed. Ts means tat te detecton as to be completed before te callee pcks up te pone. Ts mode s useful from an end-user s pont of vew snce SPIT calls can be potentally blocked wtout furter annoyance. In Fgure, pat A represents te extracton of features (call caracterstcs) of a call durng te call establsment pase (Sec. 3.). Te features are terefore lmted to source IP, From URI, To URI, and start tme of te call (Sec. 3..). Te detecton s carred out troug calculatng te dstance of te call n queston wt te current SPIT/non-SPIT clusters (Sec. 3.5). If te call s closer to te SPIT cluster n terms of te dstance metrc, t wll be regarded as a SPIT call va pat A3, wc leads to te termnaton of te pone call. Mode B: Look at te wole batc of pone calls Wt Mode B, we assume receved calls are kept n a collecton troug Pat B and B. Te calls n te collecton are ten presented n a batc to te sem-supervsed clusterng algortm. Ts detecton mode provdes ger detecton accuracy tan Mode A due to te avalablty of complete call feature nformaton. Due to te nteractve nature of VoIP calls, Mode B s probably not as attractve to an end-user as te detecton s carred out after a pone call s completed. However, we see possble applcaton from a servce provder s perspectve, wo can resort to actons aganst tose accounts tat ave been nvolved n placng SPIT calls. Ts can be used togeter wt legslatve measures n place for puntve actons aganst tose wo volate te do-not-call lst or target SPIT calls to cell pones. Also, an accurate dentfcaton of SPIT actvtes can be an ntegral part of system performance montorng. Termnate te pone call f detected as a spt call Clusters of non-spt calls. B5 Servce provder nterventon Fgure. Process flow n SPITDetector 3

5 3.4 SPIT Detecton usng Sem-Supervsed Clusterng 3.4. Clusterng & Sem-Supervsed Clusterng: Background Clusterng s a popular approac for data classfcaton wc groups data ponts nto clusters suc tat ponts n te same cluster are more smlar to eac oter tan to ponts n te oter clusters accordng to some defned crtera [3]. For example, te classcal -Means algortm [4] clusters N data ponts {x,x,,x N nto clusters {X, X,.., X wt centrods {μ, μ,, μ. Te correspondng objectve functon s tat: j= x X j x μ s mnmzed () In our problem context, eac VoIP call s regarded as one data pont. We are nterested n clusterng call data ponts nto two clusters, one contanng te SPIT call data ponts, and te oter contanng te non-spit call data ponts. In general, tere may be multple sub-clusters wtn eac cluster correspondng to radcally dfferent knds of SPIT or non-spit calls. We explore ts approac of multple sub-clusters furter n Sec Tere s abundant exstng work, suc as [5] and [6], on applyng clusterng tecnques to dentfy e-mal spam, wc furter motvates our attempt on applyng clusterng tecnque for solvng te VoIP SPIT detecton problem. Classcally clusterng s regarded as an unsupervsed data classfcaton tecnque. Ts means tat except for te crtera (lke Eq. () for -Means), tere s no need to provde some labeled data n advance as te tranng set. In classcal -Means, eac dmenson of te data pont vector x s regarded as equally mportant n te Eucldean dstance calculaton. Ts mples tat only te most relevant features sould be converted to a dmenson n a data pont vector snce te oter less-relevant features wll act as nose n te clusterng process and wll result n poorer clusterng qualty. Sem-supervsed clusterng [], [4], [6] s a recent development n te data clusterng researc communty tat ams to address te aforementoned ssue on selectng te proper crtera for clusterng. Sem-supervsed clusterng allows te use of optonal labeled data for a subset of te observatons seen at runtme to progressvely modfy te clusterng crtera. Ts means tat one does not need to worry about wc features sould go nto te data pont and wc sould not. Te clusterng crtera wll be traned nto generatng clusters tat obey te userlabeled data as fatfully as possble [6]. Te mplct assumpton s tat user feedback s perfectly accurate. In our work ere, we evaluate te mpact of nose n te user feedback Features of a VoIP call for dentfyng patterns of SPIT calls We construct a data pont for eac VoIP call based on 7 features :.From URI,.To URI, 3.Start tme, 4. Duraton, 5.# of SIP INVITE messages, 6.# of AC messages, 7.# of BYE messages from caller, 8.# of BYE messages from callee, 9. Tme snce te last call from te orgnator of te current call, -5.# of xx, xx, 3xx, 4xx, 5xx, and 6xx SIP Response messages, 6.Call frequency of te orgnator of te current call, 7.Rato of te non-slence duraton of te callee meda stream over te caller meda stream. For Mode A early detecton (Sec. 3.3), only features,, 3, and 9 are avalable. Feature 7 s derved from te RTP meda stream by clent-sde detectors f te meda streams are confgured to flow drectly between clents [5] or t can be provded by te server-sde detector f te meda streams are confgured to flow troug te SIP Proxy. In our desgn, expert knowledge on te representatveness of eac feature for dentfyng a SPIT call s not a known pror. Te desgn reles on sem-supervsed clusterng to automatcally rewegtng te mportance of eac feature n te runtme. We select features wc rougly cover dfferent facets of a VoIP call and attempt to keep a small number of features to lmt te nvolved tme/space complextes n te clusterng process User feedback as labeled data for semsupervsed clusterng As mentoned earler, sem-supervsed clusterng allows user labeled data to be suppled to tran te clusterng crtera. Here, we assume pone calls receved n te managed doman (A and C n our example Fgure ) can ave optonal user feedback nformaton ndcatng weter a call s a SPIT call or a non-spit call. Te correspondng data pont wll be labeled wt a SPIT or a non-spit tag and fed nto te sem-supervsed clusterng process. In te deal case, te effect s tat te clusterng process wll ntellgently group all SPIT calls nto one cluster and group non-spit calls nto te oter cluster and also dentfy wc call features are useful n makng ts dstncton. Te use of user feedback and sem-supervsed clusterng enables our detecton sceme to adapt to dfferent envronments. For example, n a corporate nternal VoIP system, g frequency calls could be a common case for non-spit calls, wle n a ouseold communty VoIP system, g frequency calls could be an ndcator for SPIT calls. Te user feedback can be mplemented as a Yes/No button on te pone for te user to press to ndcate a receved pone call as SPIT/non-SPIT [6]. In general, we argue aganst te use tresold-based or statc rulebased scemes for detecton of SPIT calls n VoIP envronments Extended -Means for sem-supervsed clusterng: MPC-Means For ts work, we select te sem-supervsed clusterng algortm called MPC-Means [6]. τ mpckm = x x χ ( x,x ) j x M ( x,x ) j x C ( ( )) μl log det A l Al + wj fm x,x j l lj + wj fc x,x j l = lj T () x μ = x A x A μ l l μ (3) f M x,x j = x xj + x x A j (4) l A lj C x,x j x l x x x l j A A f = (5) l l j 4

6 T A = X ( x μ)( x μ) x X T + wj ( x xj)( x xj) l lj x, xj M T + wj ( x x )( x x ) x, xj C T ( x xj)( x xj) l = lj Eq. () s te objectve functon n MPC-Means. l s te cluster tat pont x s assocated wt. Te man dea s te same as classc -Means were ntra-cluster dstance s beng mnmzed. However te Eucldean dstance metrc n MPC- Means s wegted by a cluster-specfc matrx A l (one can also use te same A matrx across all clusters. [6]). A l s modfed based on user feedback and ponts n cluster l followng Eq. (6). Te user labeled data n MPC-Means s suppled n te form of clusterng constrants M (must lnk sets) and C (cannot lnk set). Here M set specfes pars of data ponts tat sould be put n te same cluster wle te C set specfes tose pars of data ponts tat sould not be put n te same cluster. In (), te last two terms are used to add penalty to te objectve functon from te volaton of te constrants. Te functon f M returns a value proportonal to te dstance between te two ponts tat are n dfferent clusters. Te functon f C returns a value tat s nversely proportonal to te dstance between two ponts tat are n te same cluster. Te ponts x l and x l represent te two fartest data ponts n X l wt respect to ter dstance computed usng A l. Te pseudo code for MPC-Means s lsted as Algortm. Algortm: MPC-Means Input: Set of data ponts { M = ( x, xj), Set of cannot-lnk constrants C ( x, xj) { N (6) X = x, Set of must-lnk constrants = { =, Number of clusters, sets of constrants costs W and W, t. Output: Dsjont -parttonng { functon τ mpckm s locally mnmzed. Metod:. Intalze clusters:.. Create te λ negboroods { N P λ P= λ f () Intalze { μ = startng from te largest N P. Else () ntalze { μ λ = X = of X suc tat objectve from M and C. usng wegtest fartest-frst traversal N λ = wt centrods of { P P ntalze remanng clusters at random. Repeat untl convergence.. For eac data pont x X ( * = argmn x μ log det ( A ) A (, ) (, ) ) + w f x x l + w f x x = l ( x, xj) M j M j j ( x, xj) C j C j j t+ Assgn x to X *.. For eac cluster X, { x μ ( t+ ) t+ t X x X +.3. Update_metrcs A for all clusters { X = (Eq. (6)).4. t t + Algortm. MPC-Means (Adapted from [6]) Mappng user feedback to par-wse constrants n MPC-Means Te user feedback model s tat a user (te callee) n te managed doman can optonally ndcate weter a receved pone call s a SPIT or not. For te correspondng data pont x, te user ndcates x F S for a SPIT call and ndcates x F N for a non-spit call. Te system keeps two sets: F S (data ponts of SPIT calls from feedback) and F N (data ponts of non-spit calls from feedback). Wt respect to te MPC-Means algortm, must-lnk constrants M are derved onlne from pars of ponts (x, x j ) F S or (x, x j ) F N. Smlarly, cannot-lnk constrants C are created onlne from (x, x j ), were x F S and x j F N. For ease of exposton, we ntally dscuss te case wt clusters one for SPIT and te oter for non-spit calls. We dscuss te extenson to consder multple clusters for SPIT / non- SPIT calls n Sec Buldng detecton predcate based on cluster assocatons Gven a cluster X from te clusterng algortm, we use te majorty of te data ponts wt user feedback n te cluster to determne te assocaton of te cluster. If X FS > X FN, te calls n X wll be consdered SPIT calls; oterwse, tey wll be consdered non-spit calls. 3.5 empc-means (Effcent batc-mode MPC-Means) In te cluster assgnment step of MPC-Means (Step.) te tme complexty on teratng troug te must-lnk/cannot-lnk peers of pont x s a O(N) operaton. X s te wole set of data ponts suppled to te clusterng algortm. N= X s te number of data ponts. Te determnaton of te maxmally separated ponts ' x and '' x used n f c (.) (Step. of Algortm ) and update_metrcs (Step.3) as tme complexty O(N ). Ts mples MPC-Means s O(N 3 ) snce te operaton as to be done for eac data pont. Tus, MPC-Means does not scale well wt large data sets. For our applcaton, were N can be undreds for a small-szed doman or tousands for a md-szed doman, t turns out to be probtve tme-wse to apply te orgnal MPC- Means drectly. Terefore, we adapt MPC-Means nto te empc-means (effcent MPC-Means) algortm, wt te maxmally separated ponts estmated troug an O() approxmaton algortm. We use an O(N) mplementaton for te negborood creaton process n te cluster ntalzaton step of MPC-Means. Addtonally, te general practcal experence wt a -Means based algortm s tat t converges wtn a small number of teratons for te man loop Step n MPC-Means. Combned tese make empc-means lnear tme complexty wt respect to 5

7 te number of data ponts N and te constant s small for a range of VoIP call traces empc-means : Intalze clusters Te empc-means algortm creates te ntal negboroods drectly from te user feedback F S and F N sets. Specfcally, t creates w negboroods {F S, F N, x n3, x n4,, x nw, were {x n3, x n4,, x nw = X-F S -F N s te set of data ponts not covered by te user feedback. Te complexty of ts step s O(N). We use te same wegted-fartest-frst traversal as n MPC- Means, wc s O(N) wen te number of clusters s a constant [7]. Overall, te ntalze clusters n empc-means as O(N) complexty empc-means : effcent estmaton of maxmally separated ponts ( x, x ) In MPC-Means, to fnd te exact maxmally separated ponts x, x used n Eq. (5) and Eq. (6), t requres evaluatng te ( ) dstance x x j A for every par of ponts (x, x j ) X, wc s an O(N ) operaton. Snce te matrx A s updated n eac teraton of te loop of step n Algortm, ts evaluaton as to be repeated as well. In empc-means, we estmate te maxmally separated ponts by frst puttng data ponts from X nto an array R[..N] n a random orderng. We ten terate troug consecutve elements R[] and R[+] n te array. We set (, ) x x to (R[ ], R[ +]) tat gves te maxmal value of R[ '] R[ ' + ]. Ts A operaton (Step, Algortm ) s performed once rgt after te cluster ntalzaton step. Te tme complexty of ts step s O(N). However, snce te A matrx s updated n eac teraton of MPC-Means (Step.3, Algortm ), te estmate (, ) x x as to be updated accordngly as well. We embed te updatng process nto te calculaton of te parameterzed Eucldean dstance x xj (Eq. (3)). Te parameterzed Eucldean A dstance s calculated n Eq. (4) and Eq. (5) as well. Te dea ere s tat wen a par of ponts (x, x j ) s found to ave a greater dstance tan te current estmate ( x, x) at te tme of evaluatng te parameterzed Eucldean dstance, we wll set te maxmally separately ponts estmate to (x, x j ). Te advantage of ts approac s tat t s an O() operaton and does not ncrease te order of complexty of te empc-means algortm. However, ts s an approxmaton because suppose, n te loop to terate troug all te ponts, we are at pont x A and are calculatng x A - x B. Te pont x C s to be consdered n a later teraton and (x A, x C ) appens to be te fartest par of ponts. Ten, te computaton for pont x A wll not ave te accurate dstance for te fartest par of ponts. Hereafter, wen we refer to Eucldean dstance computaton, we mean tat t as maxmally separated pont estmaton embedded wtn t. To nsure tat f C (.) functon (Eq. (5)) does not evaluate to negatve values wt our approxmated estmaton of ( x, x ), we enforce tat te second term s always evaluated before te frst x, x. term so tat tere s an opportunty to update ( ) Use only a fxed number of constrants n cluster assgnment step In te cluster assgnment step of MPC-Means (Step., Algortm ), rater tan teratng troug te complete mustlnk/cannot-lnk peers of x, wc makes Step. O(N ), we coose a fxed szed subset of tem. Ts corresponds to Step 3. n empc-means (Algortm ). Ts optmzaton s nted at by te fact tat te must-lnk/cannot-lnk nformaton n our doman as sgnfcant redundancy. A set of k and k calls placed, troug user feedback, n te SPIT and non-spit categores generates k +k must-lnk and k k cannot-lnk constrants. On te oter and, we see from experment results by [6] tat MPC- Means can work reasonably well even wt lmted numbers of constrants. Togeter wt te O() complexty maxmally separated ponts estmaton, te overall tme complexty on te cluster assgnment step s brougt down to O(N). In general, ts can negatvely affect te clusterng qualty. However, we beleve t s a trade-off tat s necessary n an effort to make te detecton sceme scalable. In te followng, we wll dscuss about a doman specfc optmzaton wc can mprove te detecton qualty over MPC-Means for te cases wt lmted numbers of constrants Pre metrcs update on te startng cluster(s) In MPC-Means, te frst update metrcs step (Step.3) occurs only after te frst teraton of te cluster assgnment step (Step.). In te frst teraton of te cluster assgnment, a default dentty matrx s assgned to A, wc drectly affects te qualty of te generated clusters from te frst teraton and as a longterm effect on te qualty of te eventual clusters as we see emprcally. Terefore, n empc-means we conduct a metrcs update (Step., empc-means, Algortm ) early on, rgt after te ntal clusters are generated from te cluster ntalzaton step (Step., Algortm ). Intutvely, te user feedback s avalable at te outset and ts optmzaton allows te A matrx to mmedately adapt to te user feedback at te begnnng, wc results n more precse clusterng. Based on our experments, ts mproves te clusterng qualty and te detecton accuracy of empc-means over te orgnal MPC-Means. Addtonally, t mproves te convergence speed of te algortm as we see later (Table ). Algortm: empc-means Input: Set of data ponts { M N X = x, Set of must-lnk constrants = = {( x, xj), Set of cannot-lnk constrants C {( x, xj) =, Number of clusters, sets of constrants costs W and W, () Optonal ntal cluster centrods { μ Output: Dsjont -parttonng { functon τ mpckm s locally mnmzed. Metod: (). If ntal cluster centrods { μ, t = X = of X suc tat objectve = N λ =.. Create te λ negboroods { P P f s not gven n te nput wt steps from Sec λ Use wegtest fartest-frst traversal to select negboroods { N P. = 6

8 Else () Assgn te data ponts { X NP () Intalze { μ () { = X N λ = Intalze remanng clusters at random () Intalze { μ =.. Update metrcs A for all clusters { X = = (Eq. (6)). x x wt respect to eac A. 3. Repeat untl convergence 3.. For eac x X M { ( x, xj ) M, M = ctssze Randomly select. C ( x, xj) C, C = ctssze. Intalzaton of maxmally separated ponts (, ) ( { * = argmn x μ log det ( A ) A w (, ) j fm x, xj lj w, x (, ) j fc x xj lj ) xj M x xj C + + = t+ Assgn x to X * 3.. For eac cluster X, { x μ ( t+ ) t+ t X x X Update_metrcs A for all clusters { X = 3.4. t t+ (Eq. (6)) Algortm. empc-means Algortm sows te proposed empc-means wt te above modfcatons to MPC-Means. Step decdes te startng centrods (means) for te clusters troug te use of ntal user feedback. For te specfc case of te user flaggng calls as SPIT or non-spit, =. Step ntalzes te maxmally separated ponts estmaton. Step 3. performs te cluster assgnment. Step 3. updates te mean. Note tat te mean can be updated n constant tme by keepng te sum of te data ponts and performng an addton/subtracton wen a data pont s assocated wt/unassocated from a cluster. Step 3.3 updates te matrx A for eac cluster based on calculatng te covarance matrx on te latest clusterng results as used n Maalanobs dstance [8] and also factors n te tranng data gven n te must-lnk set M and cannot-lnk set C (Eq. (6)). Te goal of ts process s to pck te A suc tat te objectve functon (Eq. ()) s mnmzed for te cluster assgnment done n te current teraton of Step 3. From a g-level pont of vew, ts process wll result n A tat puts ger wegts on tose features wc are consstent among data ponts n te same cluster and lower wegts on tose tat are less consstent. Overall, empc-means s sown to be of O(N) complexty wtn eac teraton leadng to convergence and emprcally, te algortm needs a small number of teratons. Along wt te tme advantage, te clusterng qualty and detecton accuracy are also mproved beyond te orgnal MPC-Means algortm. 3.6 pmpc-means (Progressve MPC- Means) Bot MPC-Means and empc-means assume te data ponts are avalable n a batc, and tey are drectly suted for te Mode B (batc mode) detecton (Sec. 3.3). To support te Mode A per-call or early detecton, we create a varant called pmpc- Means. Te pseudo code s gven as Algortm 3. Te dea ere s tat wen a new call comes n, pmpc-means performs only te cluster assgnment step and only for te new data pont. Some features n te data pont lke duraton of dalog, # of ACs, # of BYEs, and # of xxx response messages wll not be avalable tll te end of te call, wle te features lke From URI, To URI, and Tme from te last call by te same caller are avalable at te begnnng of te pone call and are used n pmpc-means. For te features tat are not avalable, pmpc- Means flls te data pont x wt te mean values from te cluster to wc ts pont s dstance s beng computed. Ts s mplctly carred out n Step 4 of Algortm 3. In pmpc-means, te update metrcs operaton only occurs occasonally wen te cluster means ave canged sgnfcantly (exceedng a gven tresold d tresold ). Estmatng te mean s a O() operaton for te addton of eac data pont. Ts amortzes over many calls te cost of A computaton and te cost of reclusterng all exstng data ponts. However, a cost as to be pad n advance, wc s tat we requre reasonably szed cluster(s) to be grown on te ntal data ponts troug empc-means. Te reason s tat we want te ntal A matrx to be as accurate as possble and te tresold for te sze s denoted as t tresold n Algortm 3. Algortm: pmpc-means X = ( t ) Input: A new data pont x t., Dsjont -parttonng { {,,.., ( t ) X = x x x t. Output: te cluster assocaton l t for te pont x t. Dsjont -parttonng { X Internal Varables: { μ = Metod:. If t < t tresold ( t ) X X x t { X Return. If { X = = ( t ) { = (all clusters are empty) { X X x t. Call empc-means to generate { X of X { x,,..,, = x xt xt = =. from { μ μ = Return M { ( x, xj) M, M = ctssze 3. Randomly select. C ( x, xj ) C, C = ctssze 4. ( { * = argmn x μ log det ( A ) A X. (, ) (, ) ) + w f x x l + w f x x = l ( x, xj) M j M j j ( x, xj) C j C j j of 7

9 ( t ) 5. { X X = 6. X * X * { x t 7. If μ * μ * / x * x * > d tresold A A * * Call empc-means wt ntal centrods { μ { X = on ( t ) X. { μ μ. = Algortm 3. pmpc-means = to generate 3.7 Mult-Class empc clusterng We create a varant of empc n wc te ntal clusters are splt nto sub-clusters based on te call types calls gong to voce mal, calls termnated mmedately after te call s establsed, and te remanng calls. Tese tree types exbt dfferent patterns n te non-slence call duraton rato (feature 7, Sec. 3.4.). Te sub-clusters are formed for bot SPIT and non-spit calls. Ts s an attempt to gude te clusterng process troug expert knowledge. Te user feedback owever s only able to dfferentate between SPIT and non-spit calls, and not place a call nto a sub-cluster. 4. Experments and Results 4. Testbed We set up a two-doman testbed wt a topology smlar to Fgure, one of te domans beng protected by our detecton tecnque. We use Astersk [9] as te VoIP proxy servers and use MjSp [3] for te pone clents. Eac doman as 9 pones actng as non-sptters and 6 pones actng as sptters. We use te Posson [8] dstrbuton to model call arrval tmes and te Exponental dstrbuton to model call duratons. Te generaton of call traces was done by only one of te co-autors wtout provdng any nformaton about te mx of Non-SPIT and SPIT calls to te rest of te team. Ts was done on purpose so tat te team workng on te detecton system does not ave any pror knowledge of te call mx. Ideally we would ave lked to perform te evaluaton on trd-party call traces. However, at te tme of wrtng, no suc call trace s publcly avalable. Settng up a VoIP system wtn our unversty s also not a soluton, snce te correspondng call trace s unlkely to ave any sgnfcant number of SPIT calls. 4. Summary of call trace dataset We collected four call traces from our testbed wt varyng call caracterstcs as follows (call trace name, Non-SPIT Call lengt average, Non-SPIT Call nter-arrval tme average, SPIT Call lengt average, SPIT call nter-arrval tme average, Number of SPIT calls n trace, Number of non-spit calls n trace): (v4, 5, 3,,,, 7), (v5, 5,,,, 45, 338), (v6, 5, 3,,, 94, 89), (v7, 5, 3, 5,, 8, 3). Te tme unt s mnute. In terms of smlarty between SPIT and non-spit calls, n decreasng order, te call traces are v5, v7, v6, and v4. Tere are oter caracterstcs wc are sared by te four call traces. Examples nclude a 6% cance of a call beng ung up by te caller for a non-spit call and a % cance of beng ung up by te caller (sptter) for a SPIT call. Te meda streams for a SPIT call are domnated by te sptter wle for a non-spit call, te non-slence duraton on te caller and te callee meda streams are about te same on average. Oter expermental parameter settngs are: at most 5 mustlnk and 5 cannot-lnk constrants are used n our algortms. Te pmpc-means algortm queues data ponts ntally and runs empc-means before commencng ncremental operaton for subsequent ponts. Te convergence crteron s tat te clusterng does not cange from te prevous teraton or a prevously seen clusterng s revsted. Eac data pont n te experment s based on te average from 5 runs wt te same parameter settngs. 4.3 Effect of proporton of user feedback In ts experment, True P os tve v4 v5 v6 v7.5 ra to of ca lls wt fe e dba ck Fgure 4. Compare empc True Postve Rate across call traces 4,5,6, and 7 we evaluate te effect of te proporton of calls tat come wt user feedback. We assume te same rato for bot SPIT and non-spit calls. We assume te feedback s perfectly accurate. Fgure 5 sows te clusterng qualty wt respect to four dfferent algortms proposed on call trace 4 n terms of te F- Measure [6]. Te F-Measure s defned as follows: Precson = (# pars correctly predcted n same cluster)/(total # pars predcted n same cluster) Recall = (# pars correctly predcted n same cluster)/(total # pars n same cluster) F-Measure = ( Precson Recall)/(Precson + Recall) (7) A larger F-Measure value means better qualty clusterng. From Sec. 4., we know tat call trace 4 exbts a very clear dstncton between SPIT and non-spit calls n terms of call duraton and call nter-arrval tme. Ts makes empc perform well wt user feedback rato as low as.. Te orgnal MPC- Means aceves te same level but wt a ger user feedback rato of.. Te mproved result of empc s due to te premetrcs update (Sec ), wc creates a more accurate wegt matrx A based on user feedback, pror to teratng over te data ponts. Te F-Measure from empc Mult Class drops wt ncreasng user feedback rato because we break te cluster nto sub-clusters based on te call types. As a result, empc Mult Class wll put dfferent types of SPIT and non-spit calls nto dfferent sub-clusters. Bot wll urt te F-Measure snce by defnton of F-Measure, tese calls sould be clustered nto te same cluster. Ts negatve effect grows stronger as te user feedback rato ncreases. Fgure 6 and Fgure 7 sow te true postve and false postve rates of SPIT detecton on call trace v4. Wat we can see ere s tat empc Mult Class actually performs well despte te poor F-Measure. empc Mult Class performs worse tan empc at low user feedback rato because breakng te ntal cluster nto sub-clusters reduces te number of call data ponts wt feedback n eac sub-cluster. Ts results n poor clusterng and ence low 8

10 detecton accuracy. Compared to empc, MPC s detecton accuracy lags bend due to te lack of pre-metrcs updatng. pmpc performs rater poorly even wt call trace v4. However, t s stll n te usable range (e.g..63 True Postve wt a user feedback rato of.). pmpc s poor performance s due to te lmted features avalable before te meda stream s establsed. Due to space constrants, we sow only te True Postve curves for call traces v5, v6, and v7 n Fgure 8, Fgure 9, and Fgure respectvely. All te algortms perform worse wt call trace v5 due to same nter-arrval tme of SPIT and non-spit calls. Ts makes te tme snce last call from te same caller and call frequency (features 9 and 6 n Sec. 3.4.) muc less useful. Anoter factor s te number of SPIT calls n te call trace s decreased to 45 (compared to n v4) wc furter ampers te clusterng qualty and detecton accuracy. Fgure 4 summarzes te True Postve rates from empc across te four call traces. Ts bascally corresponds to ow salent te dfferences between SPIT calls and non-spit calls n te call traces are. In order, te easest one s v4, followed closely by v6, and ten v7. Te ardest s v5. One tng to note s tat n v5, SPIT calls are almost non-dstngusable from sort-duraton non-spit calls. We sow error-bar ( ± s.t.d.) for empc n Fgure 5. Tey are omtted n te rest of te fgures for presentaton clarty. Te general trend s tat te errors dmns wt ncreasng rato of user feedback. We observe less tan ± 5% error across te experments on call traces 4,6,and 7 wen user rato s set beyond.. For call trace 5, te error s ger (up to ± 5% at. rato). Ts s due to te fact tat trace 5 s te ardest for detecton as mentoned n prevous paragrap. F-Measure rato of calls wt feedback Fgure 5. Call trace v4 / F-Measure wt all algortms True Postve Rate rato of calls wt feedback Fgure 6. Call trace v4 / True Postve rate. False Postve Rate rato of calls wt feedback Fgure 7. Call trace 4 / False Postve rate True Postve Rate True Postve Rate True Postve Rate rato of calls wt feedback rato of calls wt feedback rato of calls wt feedback Fgure 8. Call trace 5 / True Postve Rate Fgure 9. Call trace 6 / True Postve Rate Fgure. Call trace 7 / True Postve Rate Tme (ms) Num of data ponts Fgure. MPC Runnng tme Tme (ms) Num of data ponts Fgure. empc Runnng tme MPC empc v v v v Average Table. Number of teratons to convergence 9

11 4.4 Scalablty of executon tme In ts experment we compare te runnng tmes of MPC and empc by varyng te number of call data ponts. Call trace v7 s used for ts experment. For MPC, we apply exact optmzatons wc do not cause loss of accuracy. For example, te maxmally separated ponts evaluaton s re-executed only wen te A matrx gets canged. Te results are based on code compled wt MS VC++ 8. wt default optmzaton level runnng on Wndows XP, Intel E64.3 GHz CPU. As Fgure and Fgure sows, MPC exbts non-lnear growt n te runnng tme as te number of call data ponts ncreases and s terefore non-scalable. empc, on te oter and, exbts a lnear growt n te runnng tme. Te error bars are based on ± s.t.d.. Also, MPC takes sgnfcantly longer tme to run compared wt empc wt te same number of nput data ponts. Lookng at te number of teratons tat eac algortm takes to converge (Table ), empc fares better. Te runnng tme advantage of empc comes from te lower number of teratons as well as te lower runnng tme of eac teraton. Te lower number of teratons s explaned by empc s ntal update of A s on te startng clusters. For call trace v5, te smlarty n SPIT and non-spit calls renders te A ntalzaton neffectve and te number of teratons s rougly equal for bot algortms. F-Measure Nose level True Postve Rate Nose level False Postve Rate Nose level Fgure 3. empc / F-Measure vs. Nose 4.5 Effect of nose n user feedback In ts experment, we perform an evaluaton of te dfferent algortms wt varous nose levels n te user feedback. Wen we say te nose level s c, t means tat a fracton c of te user feedback s false,.e., a SPIT call s reported as non-spit and vce-versa. We sow te result wt call trace 6 for ts experment. Te user feedback rato s fxed at.3. Fgure 3 sows te effect on te F-Measure, were te curves are symmetrc around.5 nose level. Ts s understandable snce F- Measure cares only about te clusterng qualty and not te absolute SPIT/non-SPIT cluster assocaton. Fgure 4 sows te true postve rate decreases as te nose level ncreases. Observng volume = Fgure 4. empc / True Postve vs. Nose volume = Fgure 5. empc /False Postve vs. Nose te false postve rates n Fgure 5, we conclude tat pmpc s completely unusable troug te wole nose level range wle te oter algortms are usable at low nose levels. We conclude tat pmpc s usable only for a g proporton of accurate user feedback. Beyond nose level.5 empc performance drops below tat of MPC due to our desgn of te detecton predcate (Sec ), namely, consderng te cluster tat contans more calls marked by te user as SPIT tan non-spit, to be te SPIT cluster. Wt nose level above.5, te user feedback s wrong more often tan rgt and te negatve effect s more pronounced n empc tan MPC, snce t dd a better job of clusterng on te user feedback tan MPC. As an example of a usable operatng pont, consder tat at nose levels. or below, empc as bot true postve and true negatve above.8. volume = TP - FP nose level.5 rato of feedback Fgure 6. MPC (True Postve False Postve) / call trace v6 TP - FP nose level.5 rato of feedback Fgure 7. empc (True Postve False Postve) / call trace 6 TP - FP nose level.5 rato of feedback Fgure 8. pmpc (True Postve False Postve) / call trace 6

12 4.6 Evaluaton wt nose and feedback rato Volume = ( TP FP) df dn (8) n= f =. n: nose level, f:feedback rato TP-FP Volume v4 v5 v6 v7 avg. MPC empc (Mult Class) empc pmpc Table. Summary of TP-FP volume comparsons Here we perform an evaluaton of all four proposed algortms wt respect to te four call traces. Our evaluaton metodology consders te combned effect of proporton of user feedback and te nose level and te results are sown n Fgure 6, Fgure 7, and Fgure 8. In te 3D plot, te Z-axs corresponds to (TP-FP), te dfference between True Postve rate and False Postve rate, wt respect to eac par of feedback rato and nose level. Intutvely, f (TP-FP) s greater tan zero, t means te detecton gves more correct results tan ncorrect results and can be regarded as a vald operatng pont were te detecton s useful. Due to page lengt lmtaton, we sow te 3D plots only for call trace 6. A general trend we can see n te 3D plots s tat wen fxng te nose level, te (TP-FP) value clmbs to a peak and ten goes down wen varyng te feedback rato from to. Tere s no sarp breakdown of performance for any of te algortms. If te user feedback s accurate, ten even wt low rato of user feedback, te performance s good for MPC and empc. Te performance of pmpc on te oter and s acceptable only close to te extreme regon of almost perfect user feedback for almost all calls. Expectedly, at te extreme nose level of, te peaks are at te locaton wt feedback rato ; at te extreme case of nose level, te peaks are at feedback rato. To gve an overall quantfcaton of te detecton qualty, we defne te volume metrc based on te ntegral (Eq. (8)). In te deal case were (TP-FP) s mantaned at troug te entre range of nose levels and feedback rato values, te volume wll be.9. Table sows te volume for eac combnaton of algortm and call trace. Call trace v5 gves te lowest volume correspondng to te worst performance for all algortms. Averaged over te entre range, we see tat empc performs best followed by empc (Mult Class), MPC, and pmpc. 5. CONCLUSION In ts paper, we proposed a new approac to detect SPIT calls n a VoIP envronment. We map eac pone call nto a data pont based on an extendable set of call features, derved from te sgnalng as well as te meda protocols. Ts converts te problem of SPIT detecton nto a data classfcaton problem, were a classc soluton s te use of clusterng. We apply semsupervsed clusterng, wc allows for te optonal use of user feedback for more accurate classfcaton. Ts corresponds to users flaggng some calls as SPIT and oters as legtmate. A callenge we encounter s tat te MPC-Means semsupervsed clusterng algortm s not scalable wt te number of data ponts. Furtermore, for our specfc problem on classfyng VoIP calls, t requres at least 3% of calls to ave user feedback to aceve g (> 9%) detecton true postve rates. Ts s lkely too onerous to te end users. Terefore, we create a new algortm called empc-means wc provdes emprcally lnear tme performance speedng up te performance of MPC-Means ffteen fold. It aceves ts by replacng te tmeconsumng parts n te MPC-Means algortm wt domanspecfc approxmatons. We ntroduce a pre-metrcs-update step, wc contrbutes to g (> 9%) detecton true postve rates wt less tan % user feedback data ponts for tree of te four call traces used ere. We found tat t s dffcult to attan g detecton accuracy based only on features avalable n te call establsment pase, wc would enable a SPIT call to be dropped wtout te user needng to answer te call. Ts algortm pmpc performs well only wt accurate user feedback for a majorty of calls. One possble mprovement s to nclude te trust/reputaton of callers as a feature n te clusterng. However, as mentoned earler n Sec., we would ave to address te drawbacks of classcal reputaton systems. We are also nterested n furter features tat can be extracted from meda traffc tat can ad n te classfcaton. Ts brngs n te queston of feasblty, consderng te load tat suc processng wll place on te clentsde detectors, especally consderng tat some ard pones may be qute lmted n ter processng capabltes. Implctly we ave assumed tat nose n user feedback s due to onest mstakes, not malcous users tryng to steer te clusterng n wrong drectons. How sould te system protect tself wen te assumpton s no longer true? Could t be possble to dentfy suc users and downgrade ter feedback for te clusterng process? 6. REFERENCES [] VOIPSA, "VoIP Treat Taxonomy," 8. [] Y. S. Wu, S. Bagc, S. Garg, and N. Sng, "SCIDIVE: a stateful and cross protocol ntruson detecton arctecture for voce-over-ip envronments," n DSN, 4, pp [3] H. Sengar, D. Wjesekera, H. Wang, and S. Jajoda, "VoIP Intruson Detecton Troug Interactng Protocol State Macnes," n DSN, 6, pp [4] C. J. J. Rosenberg, "RFC 539 : Te Sesson Intaton Protocol (SIP) and Spam," 8. [5] D. Sn, J. An, and C. Sm, "Progressve Mult Gray- Levelng: A Voce Spam Protecton Algortm," IEEE Network, vol., pp. 8-4, 6. [6] M. Blenko, S. Basu, and R. J. Mooney, "Integratng constrants and metrc learnng n sem-supervsed clusterng," n ICML, 4, pp [7] J. Quttek, S. Nccoln, S. Tartarell, M. Stemerlng, M. Brunner, and T. Ewald, "Detectng SPIT Calls by Ceckng Human Communcaton Patterns," n ICC, 7, pp [8] R. MacIntos and D. Vnokurov, "Detecton and mtgaton of spam n IP telepony networks usng sgnalng protocol analyss," n IEEE/Sarnoff Symposum on Advances n Wred and Wreless Communcaton, 5, pp [9] P. olan and R. Dantu, "Soco-tecncal defense aganst voce spammng," ACM Transactons on Autonomous and Adaptve Systems (TAAS), vol., 7.