Rapid and generalized identification of packetized voice traffic flows

In this paper we describe the construction and performance of classifiers able to identify Variable Rate VoIP traffic flows rapidly, reliably and independently of the application version that generated it. We show that features calculated on short sequences of packets extracted from the flow (sub-flows) are sufficient to identify VoIP flows with Recall of 99% and Precision of 90%. The features we used are based on mean packet length, autocorrelation and the ratio of data transmitted in either direction of a bi-directional flow. Even though the codecs we use to generate VoIP traffic are quite different, we show that by using selected features that capture the nature of variable bit rate voice traffic, a classifier trained on traffic generated by one version of VoIP can reliably recognize traffic generated by another version.