Thwarting Spam over Internet Telephony (SPIT) attacks on VoIP networks

The threat of voice spam, commonly known as Spam over Internet Telephony (SPIT) is a real and contemporary problem. We present two approaches based on the anomaly detection of the distributions of selected call features (i.e., day and time of calling, call durations etc.) to detect and prevent SPITting over the Internet. The first approach uses Mahalanobis Distance as a summarization tool and it is able to reliably detect individual spam VoIP calls at a microscopic level. The second approach is designed to detect groups of (potentially collaborating) VoIP spam calls at a macroscopic level. By computing entropy of call durations of groups of calls, we are able to build profile of normal calls and reliably detect the deviation from normal human call behavior that are caused by bulk spam calls.