Georgia Tech researchers design system to trace call paths across multiple networks

Phishing scams are making the leap from email to the world's voice systems, and a team of researchers in the Georgia Tech College of Computing has found a way to tag fraudulent calls with a digital "fingerprint" that will help separate legitimate calls from phone scams. Voice phishing (or "vishing") has become much more prevalent with the advent of cellular and voice IP (VoIP) networks, which enable criminals both to route calls through multiple networks to avoid detection and to fake caller ID information. However each network through which a call is routed leaves its own telltale imprint on the call itself, and individual phones have their own unique signatures, as well.

Funded in part by the National Science Foundation, the Georgia Tech team created a system called "PinDr0p" that can analyze and assemble those call artifacts to create a fingerprintâ€"the first step in determining "call provenance," a term the researchers coined. The work, described in the paper, "PinDr0p: Using Single-Ended Audio Features to Determine Call Provenance," was presented at the Association for Computing Machinery's Conference on Computers and Communications Security, Oct. 5 in Chicago.

PinDr0p exploits artifacts left on call audio by the voice networks themselves. For example, VoIP calls tend to experience packet lossâ€"split-second interruptions in audio that are too small for the human ear to detect. Likewise, cellular and public switched telephone networks (PTSNs) leave a distinctive type of noise on calls that pass through them. Phone calls today often pass through multiple VoIP, cellular and PTSN networks, and call data is either not transferred or transferred without verification across the networks.Using the call audio, PinDr0p employs a series of algorithms to detect and analyze call artifacts, then determines a call's provenance (the path it takes to get to a recipient's phone) with at least 90 percent accuracy and, given enough comparative information, even 100 percent accuracy.