V I A T. D e v e l o p e r ' s. v 0. 4

Transcription

1 V I A T D e v e l o p e r ' s G u i d e v 0. 4 Verfahren zur Identikation und Abwehr von Telefon-SPAM (Translation: Method for the Identication and Blocking of Telephone-SPAM ) Prof. Dr. Heiko Knospe M.Sc. Dirk Lentzen Dipl.-Ing.(FH) Gary Grutzek Prof. Dr. Christoph Pörschmann M.Sc. Julian Strobl Dipl.-Ing.(FH) Bernhard Mainka Institute of Communications Engineering Department of IT Security December 12, 2012

2 Project Partners: In cooperation with: Acknowledgments: A part of this work was carried out during an internship with Fraunhofer Institute for Communication, Information Processing and Ergonomics FKIE, Wachtberg, Germany. We would especially like to thank Frank Kurth for his support. For more information visit:

3 Contents 1 Introduction 1 2 Software Pre-Requirements GNU General Public License (GPL) Debian GNU/Linux 64 Bit Boost Library v1.48 with Boost Log v PostgreSQL v8.4 Database YapHash - Yet Another Perceptual Hash WaveLash - Wavelet Audio Hashing Installation Usage Documentation callx - Call Extractor Installation Usage Documentation featurex - Feature Extractor Installation Usage Documentation indexd - Index-Based Search Daemon Installation Usage Documentation mld - Matchlist Analyzer Daemon Installation Usage Documentation VirtualBox Appliance: VIAT.ova Debian GNU/Linux 64 Bit User Accounts Network Conguration Additional Packages Boost Library v1.48 with Boost Log v PostgreSQL v8.4 Database FrameWave Asterisk A and B Communication Servers Directories Usage A Basic Example... 19

4 3.2.2 Clear The Blacklist Create Your Own Call Scenarios References iii List of Figures 1 VIAT Database Scheme VIAT Testing Environment VIAT Testing Environment opened in terminal PostgreSQL administration tool opened in web browser Call ow from Asterisk A (left) to Asterisk B (right) Partial output of indexd.log with a similarity of 40% between the two calls Information about blocked caller in Asterisk A (left) List of Listings 1 Conguration le for Index-Based Search Daemon Conguration le for Matchlist Analyzer Daemon Network conguration: /etc/network/interfaces Example conguration for callles: /home/viat/scenario/minimal/congmake-callles-demo.pl Example conguration for calls: /home/viat/scenario/minimal/cong-makecalls-demo.pl

5 1 Introduction VIAT means Verfahren zur Identikation und Abwehr von Telefon-SPAM which translates to Method for the Identication and Blocking of Telephone-SPAM. VIAT is a research project (period of time: July December 2012) of the Cologne University of Applied Sciences (project management) in cooperation with the TU Braunschweig, the Fraunhofer Institute for Communication, Information Processing and Ergonomics FKIE and the companies IPTEGO GmbH and Sirrix AG. The project is signicantly nanced by the Federal Ministry of Education and Research and supported by the involved companies. Telephone-SPAM is characterized by bulk unsolicited calls. The SPAMer attempts to initiate a voice session and relays a prerecorded message if the callee answers. The prevalent Voice over IP (VoIP) technology provides convenient tools and low-priced possibilities to place a large number of SPAM calls. This document is organized as follows: In the next section we introduce our written and open sourced software and which pre-requirements should be met to get the software going. After that we describe our released VirtualBox Appliance which is already congured and with which you can easily use and test our prototype. You can even take your own audio material and create your own call scenarios. Finally the papers that we have written, are listed.

6 2 Software 2.1 Pre-Requirements In this section the software and other requirements are shown which you need to get our software going GNU General Public License (GPL) This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FIT- NESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see < Debian GNU/Linux 64 Bit All our software was developed on Debian GNU/Linux 64 Bit systems. It might be that you get our software working on other operating systems, but in the following it'll be explained for fresh debian installation. You should at least install the build-essential package, if not already done: sudo apt get i n s t a l l build e s s e n t i a l If you're just interested in YapHash (see section 2.2) and/or featurex (see section 2.4), you're good to go and you can skip the next sections. 2

7 2.1.3 Boost Library v1.48 with Boost Log v1.1 Become a superuser: sudo su Now download Boost and Boost Log: wget http : / / downloads. s o u r c e f o r g e. net /\ p r o j e c t / boost / boost / / boost_1_48_0. t a r. gz wget http : / / downloads. s o u r c e f o r g e. net /\ p r o j e c t / boost l o g / boost log 1.1. z i p Extract both: t a r xvzf boost_1_48_0. t a r. gz unzip boost log 1.1. z i p Copy the log directories into the boost installation directory: cp r boost log 1.1/ boost / l o g boost_1_48_0/ boost / cp r boost log 1.1/ l i b s / l o g boost_1_48_0/ l i b s / Finally build and install it: cd boost_1_48_0/. / bootstrap. sh show l i b r a r i e s. / bootstrap. sh with l i b r a r i e s=a l l \ p r e f i x =/usr i n c l u d e d i r=/usr / i n c l u d e l i b d i r =/usr / l i b. / bjam i n s t a l l Become a normal user again: e x i t 3

8 2.1.4 PostgreSQL v8.4 Database Installation and Conguration To get callx (see section 2.3), indexd (see section 2.5) and mld (see section 2.6) going you need a PostgreSQL database. Install it with root privileges (you need the dev-library for compiling our sources): sudo apt get i n s t a l l p o s t g r e s q l l i b p q 5 libpq dev First of all we have to allow certain IP addresses to connect. There we have to edit: sudo nano / e t c / p o s t g r e s q l /8.4/ main/ p o s t g r e s q l. conf and delete the '#' before listen_addresses. There you can type in the IP addresses you want or just leave 'localhost'. Next we need to add a user and an actual database. E.g. we have an user on our debian called viat and we want to add that user and create a database which is also called viat. First of all we need to be a superuser: sudo su p o s t g r e s and connect to the database server: p s q l template1 Now set the actual SQL commands, where mypassword is a password of your choice (hit enter after each line): CREATE USER v i a t WITH PASSWORD ' mypassword ' ; CREATE DATABASE v i a t ; GRANT ALL PRIVILEGES ON DATABASE v i a t TO v i a t ; Quit the psql-terminal with: 4

9 \q and become a normal user again: e x i t Finally we can restart the service to get all changes working: sudo s e r v i c e p o s t g r e s q l r e s t a r t VIAT database scheme and download our database scheme: In gure 1 you can see the database scheme. Become user viat sudo su v i a t ; wget https : / / raw. github. com/ v i a t / S t u f f / master /db scheme v1. 0. s q l Now connect to the empty database: p s q l d v i a t U v i a t Finally import the SQL commands: \ i db scheme v1. 0. s q l You see some information (just ignore the rst errors: These are DROP TABLE commands in case the is an old environment). You can check everything with: \d 5

10 +caller.* v_caller_blacklist +caller, caller_blacklist(): from +caller_blacklist.caller_id not in (select caller_id from caller_whitelist) AND caller_blacklist.caller_id=caller.id(): where +callee.uri +caller_id v_callee_whitelist +callee, callee_whitelist(): from +callee_whitelist.callee_id=callee.id(): where call +id #id: serial +id +caller_id: integer = not null +timestamp: timestamp +id +processed: smallint = -1 +indexed: smallint = 0 +call_id +matched_call_id +call_id +caller_id caller_blacklist matchlist +call_id: integer +matched_call_id: integer +length_query: smallint = not null +actual_mismatches: smallint = not null +offset_position: smallint = not null +processed: smallint = -1 +caller_id: integer +call_id: integer +old_call_id: integer +timestamp: timestamp +reason: varchar(50) caller +id #id: serial +id +name: varchar(60) +uri: varchar(100) +id +caller_id caller_whitelist +caller_id: integer callee +id #id: serial +uri: varchar(100) +callee_id callee_whitelist +callee_id: integer Figure 1: VIAT Database Scheme. 2.2 YapHash - Yet Another Perceptual Hash YapHash is a perceptual ngerprint for audio identication purposes. YapHash is part of the VIAT project and therefore developed for detecting telephone-spam. Although it's been optimized for speech content, it could also be used for music. Standard cryptographic hash functions have the property that minimal alterations of input data signicantly change the resulting hash value. Robust audio hashes in contrast produce identical or nearby hash values for similar input data. In particular, the audio hashes should be invariant to (certain) content degradations and hence permit a perceptual audio comparison and an ecient identication of a specic recording. Dierent recordings with similar content, e.g. identical words or phrases, or from the same speaker are not identied. The YapHash ngerprint is based on the spectrogram and Mel-frequency-cepstrumcoecients (MFCC). The sign of the dierences in between the frequency bands form a compact yet robust audio hash. 6

11 2.2.1 WaveLash - Wavelet Audio Hashing WaveLash is an addon to YapHash. Instead of using FFT and MFCCs, a J-level wavelet transform with a specic wavelet is performed. A major part of the hash is created by calculating the dierences of the variances and one bit by calculating the zero crossing rate. The resulting bit lengths of the hash values is congurable (see below). To use WaveLash, uncomment the line #define WAVELASH in main.cpp and compile the source code Installation Optionally create and change into a new directory. Get the sources via git: g i t c l o n e g i t : / / github. com/ v i a t /YapHash. g i t First install GSL - GNU Scientic Library v1.9 by changing into YapHash/gsl-1.9 and running:. / c o n f i g u r e ; make ; sudo make i n s t a l l ; Change either into YapHash/sources/Match/ or into YapHash/sources/YapHash/ and then run: make c l e a n ; make a l l ; Usage YapHash is currently a command line tool and expects at least two arguments; First is the conguration le e.g. hash.cfg, second is the input wave le. To specify the output path a third argument can be passed optionally. Example: 7

12 . / YapHash hash. c f g SPIT_01_ABEIER. wav f o u t f i l e. csv For testing purposes, an additional tool for matching audio hashes has been provided. The maximum number n of matches for two of the aboves hashes is computed. An n-match means that n vectors including their relative time osets coincide. Example:. / Match o u t f i l e 1. csv o u t f i l e 2. csv Documentation 2.3 callx - Call Extractor Installation Optionally create and change into a new directory. Get the sources via git: g i t c l o n e g i t : / / github. com/ v i a t / c a l l x. g i t Usage Documentation 2.4 featurex - Feature Extractor Installation Optionally create and change into a new directory. Get the sources via git: g i t c l o n e g i t : / / github. com/ v i a t / f e a t u r e x. g i t 8

13 2.4.2 Usage Documentation 2.5 indexd - Index-Based Search Daemon The indexd (Index Daemon) is a background process which receives new ngerprints from featurex over sockets and performs a quick search in all previous ngerprints. Therefore the ngerprints are stored and maintained in an index-like structure with the feature classes in the dictionary and tuples of call identier and position of occurrence in the postings lists. These postings list are also called inverted les or inverted list and the search method basically intersects these list with some fault-tolerance mechanisms Installation Optionally create and change into a new directory. Get the sources via git: g i t c l o n e g i t : / / github. com/ v i a t / indexd. g i t From here change into indexd/release/ and type the following and hit enter to build the software: make c l e a n ; make j 4 a l l Where -j4 is optional for using four threads while compiling Usage Since indexd is a background daemon an easy way to start it is to run the following on the command line: 9

14 . / indexd indexd. conf You can pass the conguration le as argument. Otherwise indexd expects the conguration le to be /etc/viat/indexd.conf. Conguration shown in listing 1. An example for a conguration le with all congurable parameters is Listing 1: Conguration le for Index-Based Search Daemon. 1 ########################################################################### 2 ############# Configuration f i l e f o r Index Based Search Daemon ############ 3 ########################################################################### 4 5 # S p e c i f y d i r e c t o r y to run daemon and f o r l o g g i n g output 6 LOG_DIR =. / 7 PID_DIR =. / 8 9 # Receive new f i n g e r p r i n t s 10 SOCKET_ADDR = SOCKET_PORT = # Connection s t r i n g f o r database 14 # ( connection s t r i n g has to be between quotes e. g. "dbname=v i a t "! ) 15 CONNINFO = " host = dbname=v i a t user=v i a t " # Fuzzy search ( no : 0, yes : other ) 18 FUZZY = 0 19 # Number o f matches 20 N = # Maximal time s h i f t i n samples (>= 0) 22 MAX_OFFSET = # Maximal number o f elements per query ( p o s i t i o n, f e a t u r e ) 25 # ( query, memory a l l o c a t i o n ) 26 NUMELEMOFEACHQUERY = # Logging l e v e l 29 # 1 : FATAL 30 # 2 : ERROR 31 # 3 : WARNING 32 # 4 : INFO 33 # 5 : DEBUG ( search ) 34 # 6 : TRACE ( search algorithm output ) 35 LOG_LEVEL = 4 10

15 Logging by using tail: The logging output is in the congured directory. You can follow the output t a i l f indexd. l o g Process Identier (PID) type: To quit the daemon is very easy using the PID. For example k i l l ` cat indexd. pid ` and hit enter Documentation 2.6 mld - Matchlist Analyzer Daemon The mld (Matchlist Analyzer Daemon) is a background process which check the 'matchlist' table in the database and lls the 'caller_blacklist' to be able to block a certain caller Installation Optionally create and change into a new directory. Get the sources via git: g i t c l o n e g i t : / / github. com/ v i a t /mld. g i t From here change into mld/release/ and type the following and hit enter to build the software: make c l e a n ; make j 4 a l l Where -j4 is optional for using four threads while compiling. 11

16 2.6.2 Usage Since mld is a background daemon an easy way to start it is to run the following on the command line:. / mld mld. conf You can pass the conguration le as argument. Otherwise mld expects the conguration le to be /etc/viat/mld.conf. Conguration shown in listing 2. An example for a conguration le with all congurable parameters is Listing 2: Conguration le for Matchlist Analyzer Daemon. 1 ########################################################################### 2 ############# Configuration f i l e f o r Matchlist Analyzer Daemon ############ 3 ########################################################################### 4 5 # S p e c i f y d i r e c t o r y to run daemon 6 LOG_DIR =. / 7 PID_DIR =. / 8 9 # Connection s t r i n g f o r database 10 # ( connection s t r i n g has to be between quotes e. g. "dbname=v i a t "! ) 11 CONNINFO = " host = dbname=v i a t user=v i a t " # P o l l i n g database time to p r o c e s s m a t c h l i s t ( in m i l l i s e c o n d s ) 14 SLEEP = # How equal c a l l s have to be to get b l a c k l i s t e d ( in percent ) 17 BLACKLIST_PERCENT = 85 Logging by using tail: The logging output is in the congured directory. You can follow the output t a i l f mld. l o g 12

17 Process Identier (PID) type: To quit the daemon is very easy using the PID. For example k i l l ` cat mld. pid ` and hit enter Documentation The software documentation was created with Doxygen v and can be seen by opening html/index.htm in a browser. 13

18 3 VirtualBox Appliance: VIAT.ova Asterisk A eth0: :5060 Kamailio eth0: :5060 Asterisk B eth0: :5060 Call flow --> Blacklist check Call flow (copy) PostgreSQL Call data callx eth0, promiscuous mode Blacklist data Audio Fingerprints indexd eth0: :3000 featurex eth0: :3000 Figure 2: VIAT Testing Environment. In gure 2 you can see the VIAT testing environment. There are two Asterisk communication servers. One for call generation called Asterisk A and one for call termination called Asterisk B. The SIP Express Router (SER) Kamailio transfers the calls between these servers, if the caller is not on the Blacklist. From a copy of the network stream the audio data is extracted 1 (see section 2.3) and the audio ngerprint is computed (see sections 2.2 and 2.4). After that the ngerprints are compared against all previous ngerprints (see section 2.5) and the information about possible equal or similar audio data is stored in the PostgreSQL database. With this information the Blacklist in the database is lled (see section 2.6). 1 Not yet integrated. The call extraction is handled by a perl-script which monitors the folder /var/spool/asterisk/monitor/. It writes the call metadata to the database and passes the audio material to featurex. The script is at /script/vmfd.pl. 14

19 3.1 Debian GNU/Linux 64 Bit The virtual machine is a Debian GNU/Linux 64 Bit system. In the following we describe the changes we have made to a fresh debian installation. Security updates have been installed on November 2, User Accounts We have two users. On the hand the standard superuser root and an additional user viat, which should be taken to control the virtual machine and our system. The password for both accounts is: viat Network Conguration We modied the network conguration to reach the scenario described in gure 2. You can see the changes in listing Additional Packages Some additional packages have been installed: openssh s e r v e r p o s t g r e s q l l i b p q 5 libpq dev a s t e r i s k libdatetime format iso8601 p e r l The openssh-server is for an easy connection e.g. via terminal to the virtual machine. The packages postgresql, libpq5 and libpq-dev are for the PostgreSQL database (see section and 3.1.5), where the last one is needed for compiling our sources. The last two packages asterisk and libdatetime-format-iso8601-perl are for the open source telephony software Asterisk (see section 3.1.7). 15

20 Listing 3: Network conguration: /etc/network/interfaces. 1 allow ho tpl ug eth0 2 i f a c e eth0 i n e t dhcp 3 4 auto eth0 : 0 5 i f a c e eth0 : 0 i n e t s t a t i c 6 address netmask auto eth0 : 1 10 i f a c e eth0 : 1 i n e t s t a t i c 11 address netmask auto eth0 : 2 15 i f a c e eth0 : 2 i n e t s t a t i c 16 address netmask auto eth0 : 3 20 i f a c e eth0 : 3 i n e t s t a t i c 21 address netmask auto eth0 : 4 25 i f a c e eth0 : 4 i n e t s t a t i c 26 address netmask Boost Library v1.48 with Boost Log v1.1 For further information about the installation process see section The libraries are stored in /usr/lib/ and have the format libboost_*.a resp. libboost_*.so. The header les are in a new directory in /usr/include/boost PostgreSQL v8.4 Database For further information about the installation process, the created database, tables and users see section In gure 1 you can see which information is stored in the database. 16

21 3.1.6 FrameWave Framewave is a free and open-source collection of popular image and signal processing routines designed to accelerate application development, debugging, multi-threading and optimization on x86-class processor platforms. 2 The shared libraries object can be found at /usr/lib/ starting with fw*. The libraries are needed by featurex (see section 2.4) Asterisk A and B Communication Servers We have two Asterisk servers in our testing environment. One for call generation Asterisk A and one for call termination Asterisk B (see gure 2), so that we can simulate a full call ow. Each Asterisk server needs its own network interface, so that we can passively extract the SIP and RTP data (see section 2.3). Therefore we created two virtual network interfaces. The interface eth0:0 is for Asterisk A and the interface eth0:1 is for Asterisk B (see gure 2 and listing 3). To start two instances of the asterisk software, we have two modied start scripts /etc/init.d/asta and /etc/init.d/astb. Furthermore we removed the default start script and added our two modied ones. This way you always have the Asterisk A and Asterisk B running at startup. For every instance we have new directories for the running directory: drwxr xr x 2 v i a t v i a t / var /run/ asta drwxr xr x 2 v i a t v i a t / var /run/ astb and the conguration directory: drwxr xr x 2 v i a t v i a t / e t c / asta drwxr xr x 2 v i a t v i a t / e t c / astb

22 Finally we created two new executables: / usr / sbin / asta / usr / sbin / astb and you can connect to the specic instance by passing the -r argument! Directories All directories are owned by viat. The conguration les of our software can be found in /etc/viat/, logging output is in /var/log/viat/ and pid-les are in /var/run/viat/. The conguration les of the Asterisk instances can be found in /etc/asta/ and /etc/astb/, logging output in /var/log/asta/ and /var/log/astb/ and the pid-les in /var/run/asta/ and /var/run/astb/. The transferred audio material (.wav) can be found in the directories /var/spool/asta/ and /var/spool/astb/. 3.2 Usage When starting the image two things will automatically open. On the one hand a couple of terminals with which you can control our environment (see gure 3). In the top section you can see the console of Asterisk A and Asterisk B. Theses are just for output. Later we will see our call ow and blocked calls here. In the middle section is the output of indexd (see section 2.5). If you are interested in the search algorithm, you will get some information in [1]. The bottom section is for actually control our system. We have prepared some scripts for you to get our system easily running. One the other hand you see the PostgreSQL administration tool opened in a browser (see gure 4). Username and password are both viat. In the beginning the database is empty. After running our system a little while interesting tables are matchlist, where you can see the search output about similar calls; the call table with metadata about all calls and of course the caller_blacklist, where the SER Kamailio gets its information about blocking certain callers. 18

23 Figure 3: VIAT Testing Environment opened in terminal. Figure 4: PostgreSQL administration tool opened in web browser A Basic Example To get you started very fast, we provide an example called minimal. Just run from the /script directory and see what happens:. / make c a l l s. sh /home/ v i a t / s c e n a r i o / minimal demo 19

24 Two calls are transmitted. In the top section you see the call ow from Asterisk A to Asterisk B (see gure 5). When the calls are nished the search (see section 2.5) is per- Figure 5: Call ow from Asterisk A (left) to Asterisk B (right). formed and we get a similarity between these two calls (see gure 6). The result says that Figure 6: Partial output of indexd.log with a similarity of 40% between the two calls. the actual mismatches are 60 and since the ngerprint length of each call is 100, the two calls have 40 features in the right distance in common. We can also see this information in the database table matchlist. With this information the table caller_blacklist is lled, since we require a similarity of at least 15% (see section 2.6). Note: Although the audio material came from dierent callers, our system recognizes the similarity and is able to block both callers! We can now try to make the two calls again, but now we are blocked (see gure 7). Even Figure 7: Information about blocked caller in Asterisk A (left). 20

25 if we would take other call les we wouldn't get through. Play The Audio Files levels and a little delay of 100 ms. Play the audio les and observe that they only dier in noise totem /home/ v i a t / data / minimal /SPIT_01_1. wav totem /home/ v i a t / data / minimal /SPIT_01_d100_n20p. wav Monitor The Packets We installed Wireshark for you. Just start it as root, e.g. gksudo wireshark and monitor the loopback device lo. To get the VoIP trac only, set the lter: s i p or rtp and hit Apply Clear The Blacklist If you just want to clear the blacklist but not restart our system, you can use the PostgreSQL Administration Tool (see gure 4). Just click caller_blacklist and then Empty. Done! Create Your Own Call Scenarios Create Call Files see in listing 4. First of all we need a conguration le similar to the example you Finally we change in the /script directory and run the following command: 21

26 Listing 4: Example conguration for callles: /home/viat/scenario/minimal/congmake-callles-demo.pl. 1 inpath => '/home/ v i a t / data /minimal ', 2 outpath => '/home/ v i a t / s c e n a r i o / minimal / c a l l f i l e s ', 3 c a l l f i l e n a m e => ' minimal ', 4 template => '/home/ v i a t / s c e n a r i o / template. c a l l ', 5 media_files => [ 'wav ', 'mp3 ', 'gsm ' ], 6 m i n c a l l e r => , 7 maxcaller => , 8 m i n c a l l e e => 9100, 9 maxcallee => 9999,. / create c a l l f i l e s. pl c o n f i g f i l e =\ /home/ v i a t / s c e n a r i o / minimal / config make c a l l f i l e s demo. pl 22

27 Starting Calls We need a conguration le to simulate our call ow tting our needs. You can see an example in listing 5. Listing 5: Example conguration for calls: /home/viat/scenario/minimal/cong-makecalls-demo.pl. 1 inpath => '/home/ v i a t / s c e n a r i o / minimal / c a l l f i l e s / ', 2 tmppath => '/home/ v i a t / s c e n a r i o / minimal /tmp ', 3 outpath => '/ var / s p o o l / asta / outgoing ', 4 # 0=play each f i l e j u s t once, 1=r e p l a y s are p o s s i b l e 5 mitzuruecklegen => 0, 6 # f i l e e x t e n s i o n o f c a l l f i l e s 7 c a l l _ f i l e s => ' c a l l ', 8 # s t a r t time o f s i m u l a t i o n 9 s t a r t t i m e => ' T11 : 0 0 : 0 0 ', 10 # seconds o f simulated time s l i c e 11 t i c k t i m e => 5, 12 # time o f time s l i c e r e a l i t y 13 t i c k l e n g t h => 5, 14 # maximum number o f c a l l s per t i c k 15 #call_max => 15, 16 # minimal number o f c a l l s per t i c k 17 #call_ min => 5, 18 # l e v e l o f debug output 19 verbose => 3, 20 hour_ loads => [ 21 1, 1, 1, 1, 1, 1, # 00:00 05: , 1, 1, 1, 1, 1, # 06:00 11: , 1, 1, 1, 1, 1, # 12:00 17: , 1, 1, 1, 1, 1 # 18:00 24:00 25 ], 26 # number o f c a l l s per t i c k in busyhour 27 busyhour_calls => 2, 28 # I n f l u e n c e o f randomness? 10 e q u a l s to rand_ factor => 0, 30 # play c a l l f i l e s randomly? 0=play c a l l f i l e s in order, 1=play randomly 31 random => 0, From the /script directory just run:. / make c a l l s. sh /home/ v i a t / s c e n a r i o / minimal demo 23

28 References [1] J. Strobl, G. Grutzek, B. Mainka, and H. Knospe, An Ecient Search Method for the Content-Based Identication of Telephone-SPAM, in IEEE International Conference on Communications (ICC), pp , june [2] G. Grutzek, J. Strobl, B. Mainka, F. Kurth, C. Poerschmann, and H. Knospe, A Perceptual Hash for the Identication of Telephone Speech, in 2012 ITG Fachtagung Sprachkommunikation, september [3] D. Lentzen, G. Grutzek, H. Knospe, and C. Poerschmann, Content-Based Detection and Prevention of Spam over IP Telephony - System Design, Prototype and First Results, in IEEE International Conference on Communications (ICC), pp , june [4] J. Strobl, F. Kurth, G. Grutzek, and H. Knospe, Eziente Identikation von Telefon- Spam, in Fortschritte der Akustik - DAGA 2011, DEGA e.v., pp , [5] G. Grutzek, C. Poerschmann, and H. Knospe, Vergleich spektraler Merkmale zur Identikation von Telefon SPAM, in Fortschritte der Akustik - DAGA 2010, DEGA e.v., pp , [6] H. Knospe and C. Poerschmann, Ein neues Verfahren zur Identikation und Abwehr von Telefon-SPAM, in Scientic Reports of the Cologne University of Applied Sciences, Proceedings des XXI. Deutsch-Polnischen Seminars, pp. 4953, [7] C. Poerschmann and H. Knospe, Spectral Analysis of Audio Signals for the Identication of Spam Over IP Telephony, in Proceedings of the NAG/DAGA 2009, DEGA e.v, pp , [8] C. Poerschmann and H. Knospe, Analyse spektraler Parameter des Audiosignals zur Identikation und Abwehr von Telefon-SPAM, in Sicherheit 2008, Lecture Notes in Informatics, Proceedings Sicherheit 2008, Gesellschaft für Informatik, vol. P-128, pp , iii

29 [9] C. Poerschmann and H. Knospe, Analysis of Spectral Parameters of Audio Signals for the Identication of Spam Over IP Telephony, in The Fifth Conference on and Anti-Spam, pp , iv