AVOCAD: Adaptive terrorist comms surveillance and interception using machine learning

VoIP traffic classification is becoming increasingly important in the real-time detection and disruption of drug distribution and terrorism communications. To reduce waste and inefficiency, it is important that a VoIP call detection system is highly accurate and adaptive in order to distinctly differentiate VoIP and non-VoIP calls accurately and to detect newer versions of VoIP calls if a user uses a different VoIP application to avoid detection. However, a consistent disadvantage of VoIP classifiers is that they are only useful on the VoIP version or product that they were trained on. These systems are therefore unable to accurately classify previously unseen versions of the different VoIP products. In this paper we introduce Avocad, a novel methodology for detecting different VoIP traffic products such as Skype with high accuracy. Our approach uses machine learning classifiers and network statistical features and has comparable detection accuracy and speed to existing VoIP detection applications. The uniqueness of our method is that it detects untrained versions of a VoIP application, thus helping to optimise real-time detection of VoIP traffic. Results show that our method can record an F-Measure score of up to 0.996.