6th European Conference - Academic Conferences

CAESMA – An On-Going Proposal of a Network Forensic
Model for VoIP traffic
Jose Mas y Rubi, Christian Del Carpio, Javier Espinoza, and Oscar Nuñez Mori
Pontificia Universidad Catolica del Peru, Lima, Peru
jlmasyrubi@pucp.edu.pe
delcarpio.christian@pucp.edu.pe
jmespino@pucp.edu.pe
oscar.nunez@pucp.pe
Abstract: In the near future, service convergence will be a reality, which presents us with a possible misuse
problem of these technologies. One of these services is Voice over IP (VoIP), which provides the phone
communication services in this scheme. Currently VoIP is a very popular technology, and could be use by
malicious attackers related to informatics crimes, to perform their illicit actions, which will be difficult to track
because of IP network’s nature. Because of this, our approach is to achieve a preliminary analysis to create a
forensic model for detection and tracing of VoIP traffic, which will allow us to make an adequate evidence
recollection which could be used by the police authorities.
Keywords: network forensics, forensic model proposal, voice over IP
1. Introduction
Due to the inadequate use of the telephone service in converged networks, mainly generated by
malicious attackers who misuse this technology, it becomes necessary to identify the security gaps in
this network and provide a possible solution.
Therefore, previous to the development of this article we analyze the security gaps (Annex 1), and
based on that analysis we perceive like a potential security problem “the user identification for the
calls originated from internet (VoIP)”, due to the lack of user data validation at the registration process
when the named source is use it.
This problem hinders the proper evidence recollection from the authorities, leading to the fact that
many times this acts stay unpunished due to the lack of possible identification of the attackers.
This document propose a preliminary data recollection model for a posterior forensic analysis in a
VoIP network environment for calls generated from the Internet, based on the network architecture
shown in Figure 1. For our analysis, we will rely on the Digital Forensics Research Workshop
(DFRWS) model, which is a general model for a proper digital forensic analysis.
Figure 1: Network architecture
160