Table of Contents
Fetching ...

Characterizing Robocalls with Multiple Vantage Points

Sathvik Prasad, Aleksandr Nahapetyan, Bradley Reaves

TL;DR

It is found that unsolicited calls are in slow decline, though complaints and call volumes remain high, and robocallers have managed to adapt to STIR/SHAKEN, a mandatory call authentication scheme.

Abstract

Telephone spam has been among the highest network security concerns for users for many years. In response, industry and government have deployed new technologies and regulations to curb the problem, and academic and industry researchers have provided methods and measurements to characterize robocalls. Have these efforts borne fruit? Are the research characterizations reliable, and have the prevention and deterrence mechanisms succeeded? In this paper, we address these questions through analysis of data from several independently-operated vantage points, ranging from industry and academic voice honeypots to public enforcement and consumer complaints, some with over 5 years of historic data. We first describe how we address the non-trivial methodological challenges of comparing disparate data sources, including comparing audio and transcripts from about 3 million voice calls. We also detail the substantial coherency of these diverse perspectives, which dramatically strengthens the evidence for the conclusions we draw about robocall characterization and mitigation while highlighting advantages of each approach. Among our many findings, we find that unsolicited calls are in slow decline, though complaints and call volumes remain high. We also find that robocallers have managed to adapt to STIR/SHAKEN, a mandatory call authentication scheme. In total, our findings highlight the most promising directions for future efforts to characterize and stop telephone spam.

Characterizing Robocalls with Multiple Vantage Points

TL;DR

It is found that unsolicited calls are in slow decline, though complaints and call volumes remain high, and robocallers have managed to adapt to STIR/SHAKEN, a mandatory call authentication scheme.

Abstract

Telephone spam has been among the highest network security concerns for users for many years. In response, industry and government have deployed new technologies and regulations to curb the problem, and academic and industry researchers have provided methods and measurements to characterize robocalls. Have these efforts borne fruit? Are the research characterizations reliable, and have the prevention and deterrence mechanisms succeeded? In this paper, we address these questions through analysis of data from several independently-operated vantage points, ranging from industry and academic voice honeypots to public enforcement and consumer complaints, some with over 5 years of historic data. We first describe how we address the non-trivial methodological challenges of comparing disparate data sources, including comparing audio and transcripts from about 3 million voice calls. We also detail the substantial coherency of these diverse perspectives, which dramatically strengthens the evidence for the conclusions we draw about robocall characterization and mitigation while highlighting advantages of each approach. Among our many findings, we find that unsolicited calls are in slow decline, though complaints and call volumes remain high. We also find that robocallers have managed to adapt to STIR/SHAKEN, a mandatory call authentication scheme. In total, our findings highlight the most promising directions for future efforts to characterize and stop telephone spam.

Paper Structure

This paper contains 47 sections, 16 figures, 3 tables.

Figures (16)

  • Figure 1: Audio processing pipeline
  • Figure 2: WavLM and Wav2Vec2 uncover large (outlier) campaigns while maintaining a high median cluster size
  • Figure 3: Interactive campaign disconnecting the call due to lack of engagement (no response) from Robocall Observatory
  • Figure 4: Interactive campaign engaging with Rraptor (an interactive honeypot) which yields additional details
  • Figure 5: Distribution of the top 15 categories of tracebacks of illegal robocalls used in PPoNE enforcement actions
  • ...and 11 more figures