Preventing Spam For SIP-based Sessions and Instant Messages Kumar Srivastava Henning Schulzrinne June 10, 2004

2 The Presentation… Overview of the problem of spam in SIP-based sessions Introduction to DAPES (Domain Authentication and Policy Enforcement for SIP) Introduction to “Bonded Domains” Future work and conclusion

3 Spam.. Formally, Spam can be defined as Unsolicited Bulk Communications (UBC) “Internet ” sent to a group of recipients who have not requested it The definition remains the same for SIP, but now we are talking in terms of SIP calls and instant messages

4 DAPES Supports communication with previously known and unknown entities Real-time and automated detection and classification of calls and instant messages as “spam” Prevents spoofing of domains, user identities Can be extended to ascertain trustworthiness of unknown entities

5 Domain Classification Classification of domains based on their identity instantiation and maintenance procedures plus other domain policies. Admission controlled domains Strict identity instantiation with long term relationships Example: Employees, students, bank customers Bonded domains Membership possible only through posting of bonds tied to a expected behavior Membership domains No personal verification of new members but verifiable identification required such as a valid credit card and/or payment Example: E-bay, phone and data carriers Open domains No limit or background check on identity creation and usage Example: Hotmail Open, rate limited domains Open but limits the number of messages per time unit and prevents account creation by bots Example: Yahoo

6 Authentication and Verification Verification of caller in two stages Verifying local user identities DIGEST authentication on INVITE and REGISTER Verifying outbound SIP proxies of incoming calls TLS Authentication and DNS SRV verification Reputation Information for determining trustworthiness of unknown caller Social Networks Problem can be reduced to “path existence” Does a friend I trust, trust this person Orkut, Friendster.. Reputation Systems Maintain records for domains and users and their reputation information and classification for domains. Support reputation queries and reputation updates by authenticated, valid and trustworthy users.

7 DAPES Architecture of DAPES

8 Bonded Domains Introduced in DAPES Spamming motivated by financial gains Imposes financial restrictions on potential spammers Idea is to ask users to post bonds against sending spam Have to ensure optimal bond amount and correct channeling of bond proceeds for successful working of the system

9 Reputation in social networks There are several types of social networks providing a rich source of reputation information Study aims to analyze relevant social networks and isolate features necessary for extracting correct reputation information

10 Conclusion As IP telephony becomes more popular, spammers will target SIP-based communication for sending spam It is necessary to build in features into SIP-domains to ensure that SIP-based communications do not fall prey to spam like in the case of