Research Project Led by Prof. Chunyi Peng

Combating Caller ID Spoofing on Mobile Phones

What's NEW?

• Oct 31, 2018: CEIVE received Best Demo Award at MobiCom’18. Congrats to Haotian!

• Oct 2, 2018: CEIVE On the Media inverse.com.

• Oct 1, 2018: CEIVE demo was up at Youtube, successfully combating “Consulate Phone Scam”, which has been repeatedly reported and alerted on the media:

• July 27, 2018: CEIVE was accepted by MobiCom’18.

Problem

Caller ID spoofing forges the authentic caller identity, thus making the call appear to originate from another user. This seemingly simple attack technique has been used in the growing telephony frauds and scam calls, resulting in substantial monetary loss and victim complaints. Unfortunately, caller ID spoofing is easy to launch, yet hard to defend; no effective and practical defense solutions are in place to date. We aim to develop callee-only or other practical and effective solution to help mobile users combat caller ID Spoofing.

CEIVE: Combating Caller ID Spoofing on 4G Mobile Phones Via Callee-Only Inference and Verification

CEIVE (Callee-only inference and verification) is an effective and practical defense against caller ID spoofing. It is a victim callee only solution without requiring additional infrastructure support or changes on telephony systems. We formulate the design as an inference and verification problem. Given an incoming call, CEIVE leverages a callback session and its associated call signaling observed at the phone to infer the call state of the other party. It further compares with the anticipated call state, thus quickly verifying whether the incoming call comes from the originating number. We exploit the standardized call signaling messages to extract useful features, and devise call-specific verification and learning to handle diversity and extensibility. We implement CEIVE on rooted Android phones and test it with all top four US mobile carriers, one landline and two small carriers. It shows 100% accuracy in almost all tested spoofing scenarios except one special, targeted attack case.

Watch our CEIVE demo against “Consulate Phone Scam”

Here is our CEIVE demo which successfully detects this notorious “Consulate Phone Scam” (Done on August 15, 2018).

Such scam calls were repeatdely reported and alerted by

Scam calls from Chinese consulate have been repeatedly reported and alerted by , , , , , , , , .

Many victims (Chinese in the USA) lost money up to millions of dollars, including one victim in San Francisco even lost $3M (SFgate).

You can see how serious it is over time at Google trend.

Watch our 1-min Video for MobiCom’18

Publications

• CEIVE: Combating Caller ID Spoofing on 4G Mobile Phones Via Callee-Only Inference and Verification
  Haotian Deng, Weicheng Wang, and Chunyi Peng, MobiCom’18

• Demo: Combating Caller ID Spoofing on 4G Phones Via CEIVE
  Haotian Deng and Chunyi Peng, MobiCom’18 (Best Demo Award)

Team

• Chunyi Peng (Faculty)

• Haotian Deng (PhD student, Jan 2018 - May 2019)

• Youssef Elabd (Undergrad, Nov 2018 - May 2019 )

• Yapeng Ye (PhD student, Feb 2019 - April 2019 )