{"61428":{"#nid":"61428","#data":{"type":"news","title":"Georgia Tech Researchers Design System to Trace Call Paths Across Multiple Networks","body":[{"value":"\u003Cp\u003EATLANTA \u2013 October 5, 2010 \u2013 Phishing scams are making the leap from email to the world\u2019s voice systems, and a team of researchers in the Georgia Tech College of Computing has found a way to tag fraudulent calls with a digital \u201cfingerprint\u201d that will help separate legitimate calls from phone scams.\u003C\/p\u003E\u003Cp\u003EVoice phishing (or \u201cvishing\u201d) has become much more prevalent with the advent of cellular and voice IP (VoIP) networks, which enable criminals both to route calls through multiple networks to avoid detection and to fake caller ID information. However each network through which a call is routed leaves its own telltale imprint on the call itself, and individual phones have their own unique signatures, as well.\u003C\/p\u003E\u003Cp\u003EFunded in part by the National Science Foundation, the Georgia Tech team created a system called \u201cPinDr0p\u201d that can analyze and assemble those call artifacts to create a fingerprint\u2014the first step in determining \u201ccall provenance,\u201d a term the researchers coined. The work, described in the paper, \u201cPinDr0p: Using Single-Ended Audio Features to Determine Call Provenance,\u201d was presented at the Association for Computing Machinery\u2019s Conference on Computers and Communications Security, Oct. 5 in Chicago.\u003C\/p\u003E\u003Cp\u003E\u201cThere\u2019s a joke, \u2018On the Internet, no one knows you\u2019re a dog.\u2019 Now that\u2019s moving to phones,\u201d said Mustaque Ahamad, professor in the School of Computer Science and director of the Georgia Tech Information Security Center (GTISC). \u201cThe need is obvious to build security into these voice systems, and this is one of the first contributions to that research area. PinDr0p needs no additional detection infrastructure; all it uses is the sound you hear on the phone. It\u2019s a very powerful technique.\u201d\u003C\/p\u003E\u003Cp\u003EPinDr0p exploits artifacts left on call audio by the voice networks themselves. For example, VoIP calls tend to experience packet loss\u2014split-second interruptions in audio that are too small for the human ear to detect. Likewise, cellular and public switched telephone networks (PTSNs) leave a distinctive type of noise on calls that pass through them. Phone calls today often pass through multiple VoIP, cellular and PTSN networks, and call data is either not transferred or transferred without verification across the networks.Using the call audio, PinDr0p employs a series of algorithms to detect and analyze call artifacts, then determines a call\u2019s provenance (the path it takes to get to a recipient\u2019s phone) with at least 90 percent accuracy and, given enough comparative information, even 100 percent accuracy.\u003C\/p\u003E\u003Cp\u003EPatrick Traynor, assistant professor of computer science, said that though the technology is modern, vishing is simply classic wire fraud: Someone gets a call which based on caller ID information appears legitimate, and the caller asks the recipient to reveal personal information like credit card and PIN details. During a five-day period in January 2010, bank customers in four U.S. states received fraudulent calls exactly like this, and instances of vishing date back at least to 2006.\u003C\/p\u003E\u003Cp\u003EPinDr0p is doubly effective for fraud detection, Traynor said, because it relies on call details outside the caller\u2019s control. \u201cThey\u2019re not able to add the kind of noise we\u2019re looking for to make them sound like somebody else,\u201d he said. \u201cThere\u2019s no way for a caller to reduce packet loss. There\u2019s no way for them to say to the cellular network, \u2018Make my sound quality better.\u2019\u201d\u003C\/p\u003E\u003Cp\u003EIn testing PinDr0p, the researchers analyzed multiple calls made from 16 locations as far flung as Australia, India, United Arab Emirates, United Kingdom and France. After creating a fingerprint for calls originating from each location, they were able to correctly identify subsequent calls from the same location 90 percent of the time. With two confirmed fingerprints on a call, they could identify subsequent calls 96.25 percent of the time; with three it rose to 97.5 percent accuracy. By the time researchers had five positive IDs for a certain call, they could identify future calls from that source 100 percent of the time.\u003C\/p\u003E\u003Cp\u003EBut PinDr0p does have its limitations\u2014for the moment. \u201cCall provenance doesn\u2019t translate into an individual\u2019s name or a precise IP address,\u201d said Vijay Balasubramaniyan, a Ph.D. student in computer science, who presented the PinDr0p paper in Chicago. \u003C\/p\u003E\u003Cp\u003EHowever Balasubramaniyan, Ahamad and Traynor are actively working on the next step: Using PinDr0p not just to trace call provenance, but to geolocate the origin of the call.\u003C\/p\u003E\u003Cp\u003E\u201cThis is the first step in the direction of creating a truly trustworthy caller ID,\u201d Traynor said.\u003C\/p\u003E\u003Cp\u003E###\u003C\/p\u003E\u003Cp\u003EAbout the Georgia Tech College of Computing\u003C\/p\u003E\u003Cp\u003EThe Georgia Tech College of Computing is a national leader in the creation of real-world computing breakthroughs that drive social and scientific progress. With its graduate program ranked 10th nationally by U.S. News and World Report, the College\u2019s unconventional approach to education is defining the new face of computing by expanding the horizons of traditional computer science students through interdisciplinary collaboration and a focus on human centered solutions. For more information about the Georgia Tech College of Computing, its academic divisions and research centers, please visit \u003Ca href=\u0022http:\/\/www.cc.gatech.edu\u0022 title=\u0022http:\/\/www.cc.gatech.edu\u0022\u003Ehttp:\/\/www.cc.gatech.edu\u003C\/a\u003E.\u003Cbr \/\u003E\u003Cbr \/\u003E\u003Cstrong\u003EContacts\u003C\/strong\u003E\u003C\/p\u003E\u003Cp\u003EMichael Terrazas\u003C\/p\u003E\u003Cp\u003EAssistant Director of Communications\u003C\/p\u003E\u003Cp\u003ECollege of Computing at Georgia Tech\u003C\/p\u003E\u003Cp\u003E\u003Ca href=\u0022mailto:mterraza@cc.gatech.edu\u0022\u003Emterraza@cc.gatech.edu\u003C\/a\u003E\u003C\/p\u003E\u003Cp\u003E404-245-0707\u003C\/p\u003E","summary":null,"format":"limited_html"}],"field_subtitle":[{"value":"\u2018PinDr0p\u2019 a Powerful First Step in Stopping Phone Phishing Scams"}],"field_summary":[{"value":"\u003Cp\u003EPhishing scams are making the leap from email to the world\u2019s voice \nsystems, and a team of researchers in the Georgia Tech College of \nComputing has found a way to tag fraudulent calls with a digital \n\u201cfingerprint\u201d that will help separate legitimate calls from phone scams. \u003Cem\u003ESource: Office of Communications\u003C\/em\u003E\u003C\/p\u003E","format":"limited_html"}],"field_summary_sentence":[{"value":"Researchers have found a way to tag fraudulent calls with a digital \u201cfingerprint\u201d to separate legitimate calls from phone scams."}],"uid":"27174","created_gmt":"2010-10-05 10:03:01","changed_gmt":"2016-10-08 03:07:34","author":"Mike Terrazas","boilerplate_text":"","field_publication":"","field_article_url":"","dateline":{"date":"2010-10-05T00:00:00-04:00","iso_date":"2010-10-05T00:00:00-04:00","tz":"America\/New_York"},"extras":[],"groups":[{"id":"1183","name":"Home"}],"categories":[],"keywords":[{"id":"2678","name":"information security"}],"core_research_areas":[],"news_room_topics":[],"event_categories":[],"invited_audience":[],"affiliations":[],"classification":[],"areas_of_expertise":[],"news_and_recent_appearances":[],"phone":[],"contact":[{"value":"\u003Cp\u003EFor more information, please contact Michael Terrazas at \u003Ca href=\u0022mailto:mterraza@cc.gatech.edu\u0022\u003Emterraza@cc.gatech.edu\u003C\/a\u003E or 404-245-0707.\u003C\/p\u003E","format":"limited_html"}],"email":[],"slides":[],"orientation":[],"userdata":""}}}