Digital Forensics in VoIP networks

Jérôme François (1) , Radu State (2) , Thomas Engel (1, 2) , Olivier Festor (3)

1 SnT - Interdisciplinary Centre for Security Relaibility and Trust
2 SECAN-LAB - Interoperability Laboratory for Security in Ad-Hoc Networks
3 MADYNES - Management of dynamic networks and services

With VoIP being deployed on large scale, forensic analysis of captured VoIP traffic is of major practical interest. In this paper, we present a new fingerprinting approach that identifies the types of devices (name, version, brand, series) in captured VoIP traffic. We focus only on the signaling plane and discard voice related data. Although we consider only one signaling protocol for the illustration, our tool relies on structural information trees and can easily be adapted to any protocol of that has a known syntax. We have integrated our tool within the well known tshark application in order to provide an easy to use support for forensic analysts.

Domaines: Réseaux et télécommunications [cs.NI]

Jérôme François, Radu State, Thomas Engel, Olivier Festor. Digital Forensics in VoIP networks. IEEE Workshop on Information Forensics and Security - WIFS'10, Dec 2010, Seattle, United States. pp.6. ⟨inria-00548768⟩