Sage Journals: Discover world-class research

Abstract

Spam over Internet Telephony (SPIT) is a potential source of disruption in Voice over IP (VoIP) systems. The use of anti-SPIT mechanisms, such as filters and audio CAPTCHA (Completely Automated Public Turing Test to Tell Computer and Humans Apart) can prevent unsolicited calls and lead to less unwanted traffic. In this paper, we present a game-theoretic model, in which the game is played between SPIT senders and internet telephony users. The game includes call filters and audio CAPTCHA, so as to classify incoming calls as legitimate or malicious. We show how the resulting model can be used to decide upon the trade-offs present in this problem and help us predict the SPIT sender’s behavior. We also highlight the advantages in terms of SPIT call reduction of merely introducing CAPTCHA, and provide experimental verification of our results.

Keywords

Spam prevention Spam over Internet Telephony (SPIT)Game Theory audio CAPTCHA Nash equilibria

Get full access to this article

View all access options for this article.

References

Androutsopoulos,

Magirou and

Vassilakis, A game theoretic model of spam e-mailing, in: Proc. of the 2nd Conference on Email and Anti-Spam, Stanford University, USA, 2005.

Balasubramaniyan,

Ahamad and

Park Callrank, Combating spit using call duration, social networks and global reputation, in: Proc. of the 4th Conference on Email and Anti-Spam, USA, August 2007.

Basu, The traveler’s dilemma: Paradoxes of rationality in game theory, American Economic Review 84(2) (1994), 391–395.

Braess, Über ein Paradoxon aus der Verkehrsplanung, Unternehmensforschung 12, 1968, pp. 258–268.

Bursztein,

Bethard,

Fabry,

Mitchell and

Jurafsky, How good are humans at solving CAPTCHA? A large scale evaluation, in: Proc. of the 2010 IEEE Symposium on Security and Privacy, USA, 2010, pp. 399–413.

Cavusoglu and

Raghunathan, Configuration of detection software: A comparison of decision and game theory approaches, Decision Analysis 1(3) (2004), 131–148.

Daskalakis,

P.W.

Goldberg and

C.H.

Papadimitriou, The complexity of computing a Nash equilibrium, Commun. ACM 52(2) (2009), 89–97.

Dritsas,

Tsoumas,

Dritsou,

Konstantopoulos and

Gritzalis, OntoSPIT: SPIT management through ontologies, Computer Communications 32(2) (2009), 203–212.

Federal Communications Commission, FCC strengthens consumer protections against telemarketing robocalls, in: The Matter of Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991, CG Docket No. 02-278, February 15, 2012.

10.

Federal Trade Commission, Do-Not-Call Implementation Act of 2003, Public Law No. 108-10, June 2003.

11.

Federal Trade Commission, National Do Not Call Registry Data Book for Fiscal Year 2012, October 2012.

12.

Federal Trade Commission, FTC Settles “Rachel” Robocall Enforcement Case (http://www.ftc.gov/opa/2013/07/aplus.shtm, retrieved 23 October 2013).

13.

Graham-Rowe, A sentinel to screen phone calls technology, MIT Review (2006).

14.

Gritzalis,

Katos,

Katsaros,

Soupionis,

Psaroudakis and

Mentis, The Sphinx enigma in critical VoIP infrastructures: Human or botnet?, in: Proc. of the 4th International Conference on Information, Intelligence, Systems and Applications, IEEE Press, 2013.

15.

Gritzalis,

Katsaros,

Basagiannis and

Soupionis, Formal analysis for robust anti-SPIT protection using model-checking, International Journal of Information Security 11(2) (2012), 121–135.

16.

Gritzalis,

Marias,

Rebahi,

Soupionis and

Ehlert, SPIDER: A platform for managing SIP-based spam over Internet Telephony, Journal of Computer Security 19(5) (2011), 835–867.

17.

Johnson,

Grossklags,

Christin and

Chuang, Are security experts useful? Bayesian Nash equilibria for network security games with limited information, in: Proc. of the 15th European Symposium on Research in Computer Security, Greece, September 2010, pp. 588–606.

18.

Johnston, SIP: Understanding the Session Initiation Protocol, 2nd edn, Artech House, 2004.

19.

Kanich,

Kreibich,

Levchenko,

Enright,

Voelker,

Paxson and

Savage, Spamalytics: An empirical analysis of spam marketing conversion, in: Proc. of the 15th ACM Conference on Computer and Communications Security, USA, October 2008, pp. 3–14.

20.

Keromytis, Voice-over-IP security: Research and practice, IEEE Security and Privacy 8(2) (2010), 76–78.

21.

Keromytis, A comprehensive survey of voice over IP security research, IEEE Communications Surveys & Tutorials 14(2) (2012), 514–537.

22.

Kim,

Park and

Lee, Using stated-preference data to measure the inconvenience cost of spam among Korean e-mail users, Applied Economics Letters 13(12) (2006), 795–800.

23.

Lowd and

Meek, Good word attacks on statistical spam filters, in: Proc. of the 2nd Conference on Email and Anti-Spam, USA, 2005, pp. 21–22.

24.

M.H.

Manshaei,

Zhu,

Alpcan,

Bacşar and

J.P.

Hubaux, Game theory meets network security and privacy, ACM Comput. Surv. 45(3) (2013), 25:1–25:39.

25.

McKelvey,

Richard,

McLennan and

Turocy, Gambit: Software Tools for Game Theory, Version 0.2010.09.01, available at: http://www.gambit-project.org.

26.

R.B.

Myerson, Game Theory: Analysis of Conflict, Harvard Univ. Press, Cambridge, MA, 1991.

27.

Niccolini,

Tartarelli,

Stiemerling and

Srivastava, SIP Extensions for SPIT Identification, Internet Draft, Network Working Group, 2007, draftniccolini-sipping-feedback-spit-03.

28.

Nisan,

Roughgarden,

Tardos and

V.V.

Vazirani, Algorithmic Game Theory, Cambridge Univ. Press, New York, NY, USA, 2007.

29.

Osborne, An Introduction to Game Theory, Oxford Univ. Press, 2003.

30.

Osborne and

Rubinstein, A Course in Game Theory, The MIT Press, 1994.

31.

Owen, Game Theory, Academic Press, 1982.

32.

C.H.

Papadimitriou, Algorithms, games, and the Internet, in: Proceedings of the 33rd ACM STOC, New York, NY, USA, 2001, pp. 749–753.

33.

Parameswaran,

Rui and

Sayin, A game theoretic model and empirical analysis of spammer strategies, in: Proc. of the Collaboration, Electronic Messaging, Anti-Abuse and Spam Conference, 2010.

34.

Patankar,

Nam,

Kesidis and

Das, Exploring anti-spam models in large scale VOIP systems, in: Proc. of the 28th International Conference on Distributed Computing Systems, China, June 2008.

35.

Quittek,

Niccolini,

Tartarelli,

Stiemerling,

Brunner and

Ewald, Detecting SPIT calls by checking human communication patterns, in: Proc. of the IEEE International Conference on Communications, UK, 2007, pp. 1979–1984.

36.

Rosenberg and

Jennings, The Session Initiation Protocol (SIP) and spam, Network Working Group, RFC 5039, January 2008.

37.

Sawda and

Urien, SIP security attacks and solutions: A state-of-the-art review, in: Proc. of the IEEE International Conference on Information and Communication Technologies, April 2006, pp. 3187–3191.

38.

A.B.

Shahroudi,

R.H.

Khosravi,

H.R.

Mashhadi and

Ghorbanian, Full Survey on SPIT and prediction of how VoIP providers compete in presence of SPITTERS using Game-Theory, in: Proc. of the 2011 IEEE International Conference on Computer Applications and Industrial Electronics (ICCAIE), Abu Dhabi, 2011, pp. 402–406.

39.

Shin,

Ahn and

Shim, Progressive multi gray-leveling: a voice spam protection algorithm, IEEE Network 20(5) (2006), 18–25.

40.

Sinnreich and

B.A.

Johnston, Internet Communications Using SIP: Delivering VoIP and Multimedia Services with Session, 2nd edn, Wiley Publishing, 2006.

41.

Soupionis,

Dritsas and

Gritzalis, An adaptive policy-based approach to SPIT management, in: Proc. of the 13th European Symposium on Research in Computer Security, Springer, 2008, pp. 446–460.

42.

Soupionis and

Gritzalis, Audio CAPTCHA: Existing solutions assessment and a new implementation for VoIP telephony, Computers & Security 29(5) (2010), 603–618.

43.

Soupionis and

Gritzalis, ASPF: An adaptive anti-SPIT policy-based framework, in: Proc. of the 6th International Conference on Availability, Reliability and Security, Austria, August 2011, pp. 153–160.

44.

Tambe,

Jain,

J.A.

Pita and

A.X.

Jiang, Game theory for security: Key algorithmic principles, deployed systems, lessons learned, in: 50th Annual Allerton Conference on Communication, Control, and Computing, 2012, pp. 1822–1829.

45.

Vassilakis,

Androutsopoulos and

Mageirou, A game-theoretic investigation of the effect of human interactive proofs on spam e-mail, in: Proc. of the 4th Conference on Email and Anti-Spam, USA, 2007.

46.

Walsh and

Kuhn, Challenges in securing voice over IP, IEEE Security and Privacy 3(3) (2005), 44–49.

47.

Wilson, Competition may be driving surge in botnets and spam, available at: www.darkreading.com/security/security-management/208803799.

A game-theoretic analysis of preventing spam over Internet Telephony via audio CAPTCHA-based authentication

Abstract

Keywords

Get full access to this article

References