SPIT architectural issues

1
SPIT architectural issues

• Henning Schulzrinne
• Columbia University
• (based partially on draft-tschofenig-sipping-frame
  work-spit-reduction-03)

2
Unsolicited communications

• IMs
• SUBSCRIBEs
• Calls
• email-spam like robots, canned
• revival of telemarketing
• just from Bangalore or Lagos
• bypass Do-Not-Call list regulations
• Residence and enterprise
• most spam products sold to enterprises today

3
Bot nets

• May dominate SPIT problem
• Three kinds
• fake identity
• real identity (of unwitting host)
• random destinations
• destinations from host address book or Facebook
  friends list

4
User behavior

• Closed groups
• only communicate within group
• example children
• Semi-open groups
• mostly within group
• plus introductions, possibly by other means
  (e.g., email)
• example research staff in company
• Open groups
• communicate with public
• examples PSAP, call center, front desk

5
The cast
oracle
honey pot
alice_at_smith.org
caller.com
isp.com
smith.org
peering
all proxies are optional
columbia.edu
6
Mechanism

• Mechanisms likely to evolve
• No single best mechanism
• type of destination
• residence vs. business vs. PSAP
• cost of false positive vs. false negative varies
• SPIT evolves
• Volume and duration by itself insufficient
• reverse 911
• school closing calls at 5 am

7
Classes of mechanisms

• Identity-based
• at callee
• relationship to other identities (web pages,
  email)
• Statistics
• at origin or destination
• Price-based
• make incoming or outgoing calls expensive
• monetary, computational or human resources
  (CAPTCHA)

8
Detection vs. action

• Detection of call characteristics
• caller statistics
• not visible to one destination
• Action based on characteristics policy
• same characteristics different policy --
  different actions
• e.g., reject - Turing test - voice mail

9
Mechanisms
Is bob_at_caller.com a SPIT bot?
Does caller.com host SPITers?
Trust?
BL
Is Bob making more than 100 calls/day?
WL
10
Identity crisis

• Assumption
• RFC 4474 provides strong identity assurance
• needed for white lists
• Reality
• E.164 draft-rosenberg-sip-rfc4474-concerns-00
• Baiting draft-kaplan-sip-baiting-attack-02

11
Communicating
oracle queries
call properties
policy language
update and share
BL
WL
12
Whats to do?

• Many evolving mechanisms
• Components from different vendors
• Need for glue to allow distributed mechanism,
  e.g.,
• mechanisms to convey metrics downstream
• mechanisms to query oracles
• policy language to allow automated decisions
• email Sieve
• RAI common policy

13
Summary

• Separate mechanisms from communication protocols
• Separate call evaluation and measurement from
  policy
• Allow for multiple parties
• service providers, trust brokers,
• Both mechanisms and tools likely to evolve
• keep communication tools one step ahead in
  generality