IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. X, NO. X, MONTH 2011 1 A Supplement to “Identification of Peer-to-Peer VoIP Sessions Using Entropy and Codec Properties” Joao˜ V. Gomes, Pedro R. M. Inacio,´ Manuela Pereira, Mario´ M. Freire, and Paulo P. Monteiro Abstract—This supplement is organized as follows. Appendix A presents the speech codecs analyzed in this work and describes how we studied the codecs used in the different versions of Skype. Appendix B explains how entropy was used to express the heterogeneity of the packet lengths and how it was computed in real-time. Appendix C describes several details regarding the analysis of the traffic generated by Voice over Internet Protocol (VoIP) sessions with different speech codecs. Appendix D briefly explains the modular architecture of the classifier proposed in the main article. Appendix E characterizes the testbed and the datasets used for the performance evaluation of the proposed method, describes the composition of the datasets, presents additional details and results regarding the performance evaluation included in the main article, and describes the analysis of the computational resources used by the proposed classifier. Index Terms—Data communications, distributed applications, network communications, network management, network monitoring, packet-switching networks. F Appendix A these aspects, Constant Bit Rate (CBR) codecs generate Studied Codecs packets with constant lengths, while the data generated by Variable Bit Rate (VBR) codecs depends also on the The analysis presented herein and the proposed classifier signal they are encoding. Consequently, the packets used are both based on the speech codecs used in Voice over to transmit the data created with distinct codecs through Internet Protocol (VoIP) sessions. We studied the lengths the network present different lengths. of the packets generated by VoIP sessions using several All the codecs used by more than one of the selected codecs by observing several traffic samples of each of applications, presented in Table 1 of the main article, the codecs included in Table 1 of the main article and were studied in this work. In the case of Skype, all the we tried to identify patterns for each of them. codecs it supports were analyzed as they are mostly pro- Speech codecs use audio processing techniques and prietary codecs that are not used by other applications. compression algorithms to encode analog audio into A common codec used in VoIP sessions is PCM, digital signal. In order to turn a continuous signal into a standardized in the G.711 recommendation of the Inter- discrete signal, codecs take samples of the analog signal. national Telecommunication Union (ITU). G.711 defines Additionally, codecs process the analog signal in frames two main compression algorithms, the µ-law algorithm with a limited size which contain a segment of the (used primarily in North America and Japan) and the signal. Most codecs use different sampling frequencies A-law algorithm (used in Europe and the rest of the (the number of samples per second) and frame sizes, world). The two versions of PCM are usually referred by which influences the amount of data transmitted in a the applications as PCMU and PCMA, respectively. For VoIP call. For instance, G.729 has a sampling frequency the sake of coherence, the same designations are used in of 8 kHz with samples of 16 bits and uses a frame size the main article. G.722 is based on Sub-Band Adaptive of 10 ms, while Pulse-Code Modulation (PCM) has a Differential Pulse Code Modulation (SB-ADPCM), which sampling frequency of 8 kHz with samples of 8 bits and uses the baseline of PCM. Speex codec was also analyzed. the G.711 standard does not fix a frame size. Moreover, It has three modes, ultra-wideband (sampling rate of speech codecs use different compression algorithms and 32 kHz), wideband (16 kHz), and narrowband (8 kHz) some of them prioritize audio quality, while others try to and supports CBR and VBR. minimize the bandwidth used in a VoIP session. Besides Although the Global System for Mobile J. Gomes, P. In´acio, M. Pereira, and M. Freire are with Instituto de communications (GSM) is a standard for mobile • Telecomunicac¸˜oes,Department of Computer Science, University of Beira telephone systems, it is commonly used to identify Interior, Portugal. a speech codec. The original GSM speech codec is E-mail: [email protected], inacio, mpereira, mario @di.ubi.pt P. Monteiro is with Nokia Siemensf Networks Portugal,g S. A., with named Regular Pulse Excitation Long-Term Prediction • University of Aveiro, and with Instituto de Telecomunicac¸˜oes. (RPE-LTP). Nonetheless, as VoIP applications use the E-mail: [email protected] term GSM to refer to the codec, the same designation is used in this article. IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. X, NO. X, MONTH 2011 2 The Global IP Solutions (GIPS) company delivers em- Packet bedded solutions used for communications. It offers a set ... Packet #p+1 Packet #p of proprietary codecs that includes Internet Speech Au- Processor dio Codec (iSAC), Internet Low Bit Rate Codec (iLBC), ... Internet Pulse Code Modulation wideband (iPCMwb), ¼ 60 82 ... 54 60 ¼ ... and Enhanced G.711 (EG711) U/A. From these, only iLBC ¼ 54 54 ... 54 60 ¼ is royalty-free. In May 2010, GIPS was bought by Google flowflow ff and its codecs are now used by Google Talk. N packets All versions of the Skype software from 2.0 were tested to identify the different codecs supported throughout its ¼ 170 170 170 110 ... 170 124 170 124 ¼ evolution. The versions prior to 2.0 were not used as they seem to not be able anymore to connect to the entropy on iteration i-1 entropy on iteration i+1 authentication server of Skype. In order to know the entropy on iteration i codecs used by Skype in each version of the software, Fig. 1. An independent sliding window with size of N we started by identifying the codec used in a VoIP packets contains the lengths for each identified flow, and session by activating the display technical call info option one entropy value is calculated in each iteration. in the Skype client. Afterwards, we used the DisableCodecs tag in the config.xml file to iteratively disable every codec until no codec is left. We repeated this process of distinct occurrences under analysis. In this article, for every Skype version and we concluded that, before entropy is used to measure and apply the heterogeneity version 3.0, Skype used G.729, PCM U/A, and the GIPS of the lengths of the packets from the analyzed traffic. codecs. In version 3.0, it stopped using iPCMwb and the Hereinafter, any mention of entropy refers to the entropy support for Adaptive Multi-Rate Wideband (AMR-WB) of the lengths of the packets. was added. From version 3.2 to 4.0, Skype used G.729, PCM U/A, AMR-WB and Sinusoidal Voice Over Packet Since, by definition, entropy is calculated for a set Coder (SVOPC), a proprietary codec from Skype. In of values, based on the probability of each value, it is version 4.0, it stopped using AMR-WB and SILK, another necessary to define to which set of lengths the entropy Skype proprietary codec, was introduced. SILK has super- should be calculated when analyzing aggregated traffic wideband (24 kHz) and wideband (WB) (16 kHz) modes from one or more hosts. Given the goal of identifying and, since version 4.1 of Skype, it also has mediumband VoIP flows, one option would be to calculate entropy (MB) (12 kHz) and narrowband (NB) (8 kHz) modes. for all the packets of each complete flow. However, Another codec, identified by NWC in the config.xml such approach would produce a classification only at file, is used since version 4.1 of Skype. Although in our the end of the flow, preventing its application to real- analysis it presented properties similar to the ones from time analyses. Moreover, any characteristics resulting PCM, it was not possible to find any further information from occasional behaviors in the middle of a flow might regarding this codec. compromise the results of the analysis for the complete flow. Alternatively, if the value of entropy was obtained for intervals of time, the conclusions would also depend Appendix B on the packet rate in each flow and a classification result Expressing Heterogeneity Through Entropy would only be produced at the end of each interval. The concept of entropy introduced by Shannon in the Therefore, instead of calculating the entropy for each information theory [1] is used in this article to assess the complete flow or for time intervals, it was implemented level of heterogeneity. Shannon presented entropy as a a method based on a sliding window with a constant measure of the uncertainty of a random variate. Entropy, size of N packets, as depicted in Fig. 1. For each flow, denoted by H(x), is defined by an independent window is used. Every time a new packet arrives, the flow to which the packet belongs is n X identified and the length of the packet is added to the H(x) = p(xi) ln p(xi); (1) − corresponding window. When a new length is added, i=1 the oldest length in the window is dropped, creating the where n is the number of distinct occurrences of x, and virtual movement of the sliding window. p(xi) is the probability of the particular occurrence of The entropy is calculated for the lengths within the xi. For any finite number of occurrences m N, the 2 sliding window in each iteration, as exemplified in Fig.