To help trace fraudulent activities or gather forensic evidence, telecom service providers need a solution that can not only identify relevant OTT service application data but also reconstruct the phone numbers used in OTT calls, revealing the parties involved in the communication. For OTT call analysis, beyond identifying OTT applications, the solution must include these key features:

• OTT Traffic Identification:Accurately detect OTT services (e.g., WhatsApp, LINE, Telegram) and distinguish communication types like voice, video, and messaging.
• OTT Call User Identification:Trace and reconstruct phone numbers or device IDs from OTT call traffic to help identify users, including details like MSISDN, IMEI, IMSI, cell tower ID, and tower location, etc.
• Data Retention & Analytics:Support robust data storage and retrieval, offering detailed reports for investigative purposes.

This solution would significantly improve law enforcement’s ability to track and reconstruct communication data in OTT environments, enabling more effective fraud and criminal investigations. However, providing OTT call analysis features faces several technical challenges:

• Variety of OTT technologies:The diverse technologies used by various OTT services for call initiation and reception make it difficult to extract accurate caller and callee information from large volumes of network traffic. For instance, identifying caller and callee details becomes complex when calls are established using P2P, relay servers, hybrid or server-side combination modes.
• Private IP addresses complicate the problem:In telecom networks, devices like CGNAT (Carrier-Grade NAT) introduce technical difficulties in identifying OTT call participants, as intermediaries like STUN (Session Traversal Utilities for NAT) and TURN (Traversal Using Relays around NAT) servers often obscure the true source and destination of the communication.
• Data Analysis and Performance Challenges:Identifying OTT services and their specific application types (e.g., voice, video, or messaging) within large-scale, carrier-grade networks necessitates continuous traffic monitoring, leading to immense data volumes. Handling this data requires substantial computing power and efficient storage to ingest, process, visualize, and retain analytics over time, presenting challenges in both data analysis and storage/access performance.