1. Forensic Framework for Skype Communication
Presented By
Manesh T
Faculty and Research Fellow
Department of Computer Science & Information Prince Sattam bin Abdulaziz University, KSA
Shankara Research Centre In Information Science
Adi Shankara Institute of Engineering and Technology.
Resource Center for Cyber Forensics
CDAC Trivandrum
Co-Authors
M Muhammed Sha Saied M. Abd El-atty
Department of Computer Science & Information Prince Sattam Bin Abdulaziz University
Kingdom of Saudi Arabia

2. Agenda Brief Introduction Application Environment & Basic Problem
Background and Previous works
Proposed Solution
Core Invention and Features of Research
Achievements and Results
Conclusions and Future Works
References

3. Brief Introduction Retrospective network analysis or Network Forensics
Network forensics is the science that deals with capture, recording, and analysis of network traffic(packets) to retrace the content of the network session.
We do Skype forensics through offline network Forensics.

4. Application Environment and Basic Problem
Encrypted channels in Skype
Difficult Forensic Analysis
Unbound usage of Skype VoIP
Problems

5. Background and Previous Work
Ideal Features C
Collection & filtering R
Correlation Analysis L
Log file analysis S
Stream Reassembly A
Application layer viewer W
Workflow or case management
None Perform Skype Forensics

6. Proposed Solution- Experimental Setup
Innovative Approach

7. Core Invention and Features of Research
Skype SSL Handshake Process
Decrypting Skype Traffic , Regenerating VoIP data
Tracing malicious users and network session contents
Facilitating law enforcement
Used with Proxy servers or Stand alone PCs
Features

8. SIP and RTP Rescheduling Technique
Algorithm 1
Algorithm 2

9. Achievements and Results
GUI of Skype SIP Decrypter
GUI-VoIP Header Extractor and Regenerated Details

10. Conclusions and Future Scope
Admin friendly framework - Skype VoIP Streams.
Traces Unauthorized Skype VoIP network activities.
Successfully decrypted the Skype SSL handshake
Facilitates prosecution of the malicious user
Results shows that new packet reconstruction mechanism which is developed to address duplicate and retransmitted packets is functioning commendably.
Our future work involves complete Skype communication analysis by decrypting SRTP communication between clients.

11. References
1. S. A. Baset, H Schulzrinne.: An Analysis of the Skype peer-to-peer Internet Telephony Protocol. In: IEEE INFOCOM’ 06, pp. 1—11. April (2006). 2. Guha. S, Daswani. N,: An An experimental Study of Skype peer to peer VoIP System. In: IPTPS’ 06, pp. 10—16. Feb (2006). 3. Chun-Ming. Leung, Yuen-Yan. Chan,: Network Forensic on Encrypted Peer-to-Peer VoIP Traffics and the Detection, Blocking, and Prioritization of Skype Traffics. In: 16th IEEE International Workshops on Enabling Technologies, pp. 401—408. June (2007). 4. Molnar. S, Perenyi. M, Gefferth. A, Trang. Dinh. Dang, : Skype Traffic Identification. In: IEEE Global Telecommunications Conference, pp Nov (2007). 5. Ronald. C. Dodge, J.R,: Skype Fingerprint. In: IEEE Proceedings of the 41st Annual Hawaii International Conference on System Sciences, pp. 484—452. January (2008). 6. Rossi. D, Mellia. M, Meo. M,: Evidences Behind Skype Outage. In: IEEE International Conference on Communications, pp. 1—6. June (2009). 7. Tinta. S.P, Wong. J.L, : Characterizing end-to-end packet reordering with UDP traffic. In: IEEE Symposium on Computers and Communications, pp. 321—324. July (2009). 8. Manesh. T, B. Brijith, Mahendra. Prathap. Singh, :An Improved Approach towards network Forensic Investigation of HTTP and FTP Protocols. In: PDCTA-11, Springer Heidelberg, pp. 385—392. Sept (2011) 9.Manesh. T, B.Brijith, Bhraguram. T. M, R. Rajaram, : Network Forensic Investigation of HTTPS Protocol. In: IJMER, Vol. 3, Issue. 5, pp Oct (2013).

12. THANK YOU !