Analysis of Skype and its Detection

Abstract

20] employed X-means clustering to their work. Although X-means is basically equivalent to k-means, it does not require the assignment of the number of clusters in advance. Xiang Li et.al.[21] applied Support Vector Machine learning based on flow statistics to identify and classify network applications. Nowadays, researchers are more or less attracted towards statistical based approach as it does not involve packet payload data. Many researchers attempted to build statistical classifier models based on full flow feature, but these full flow features approaches exhibit slower computational performance. Now a day, instead of full flow feature researchers have started the use of sub-flow features [5], [22]-[24]. Thus the packet size and inter-arrival time are more effective measurable features in early classification of network flows [5], [25], [26]. Fig.1. Data Collection Architecture III. DATA COLLECTION Network traces are collected from our test-bed, at the edge of our University Network (Figure 1) and from publicly available traces of Tstat [27] [28]. Figure 2 shows the test-bed is setup at Network Security Lab, M.U. (Manipur University) which generate various VoIP application traces. And using gt's [29] method we collect ground truth application traces. A Napatech data capture card, NT4E-STD [30] was used to capture traces on our log server at the edge of our University Network (Figure 1). An Asterisk based VoIP server is also running at the public domain to collect the Asterisk based VoIP applications traces. We also collected various types of Skype and non-Skype traces such as voice, video, silence call, call within LAN and WAN, etc. Data were Data were generated using the VoIP clients such as Skype (Beta) version 2.2.0.35, linphone 3.5.2