A comprehensive study of flooding attack consequences and countermeasures in Session Initiation Protocol (SIP)

Abstract

Session Initiation Protocol (SIP) is widely used as a signaling protocol to support voice and video communication in addition to other multimedia applications. However, it is vulnerable to several types of attacks because of its open nature and lack of a clear defense line against the increasing spectrum of security threats. Among these threats, flooding attack, known by its destructive impact, targets both of SIP User Agent Server (UAS) and User Agent Client (UAC), leading to a denial of service in Voice over IP applications. In particular, INVITE message is considered as one of the major root causes of flooding attacks in SIP. This is due to the fact that an attacker may send numerous INVITE requests without waiting for responses from the UAS or the proxy in order to exhaust their respective resources. Most of the devised solutions to cope with the flooding attack are either difficult to deploy in practice or require significant changes in the SIP servers implementation. Apart from these challenges, flooding attacks are much more diverse in nature, which makes the task of defeating them a real challenge. In this survey, we present a comprehensive study of flooding attack against SIP, by addressing its different variants and analyzing its consequences. We also classify the existing solutions according to the different flooding behaviors they are dealing with, their types, and targets. Moreover, we conduct a thorough investigation of the main strengths and weaknesses of these solutions and deeply analyze the underlying assumptions of each of them for better understanding of their limitations. Finally, we provide some recommendations for enhancing the effectiveness of the surveyed solutions and address some open challenges. Copyright © 2015 John Wiley & Sons, Ltd.

Countering DDoS Attacks in SIP Based VoIP Networks Using Recurrent Neural Networks

“…The attacker could be a legitimate user if such attacker has an account in the SIP server, or even an intruder who has violated the authentication requirements. Furthermore, this attack can be launched using a single source (i.e., DoS attack) or multiple sources (i.e., DDoS attack) to send INVITE messages to the end-user or the server [ 38 ].…”

Survey of Countering DoS/DDoS Attacks on SIP Based VoIP Networks

“…Moreover, they analyzed four articles and evaluated them according to their advantages and limitations. Hussain et al [14] introduced a comprehensive study of SIP flooding DoS attacks. They classified the research work reviewed (consisting of 26 publications) according to attack behavior, attack type (internal or external), and attack target (proxy server or end-user).…”

“…From the previous discussion, it can be noted that published surveys are either limited in their scope to a specific type of DoS attacks [13,14] or examined them with limited aspects of comparison [15] or did not provide a review of the recently published articles [16]. Hence there is a need for a recent and in-depth survey.…”

Distributed SIP DDoS Defense with P4

“…A comprehensive survey paper on VoIP security research indicates that half of DoS-related vulnerabilities are on the endpoints [10]. Hussain et al (2015) in their comprehensive study of flooding attack wrote that SIP INVITE message is considered as one of the major root causes [7], and applicationlevel DDoS flooding attacks like SIP remain to be an open problems [12]. Some of the related works that use destinationbased as well as source-based approach are as follows: Ormazabal et al (2008) [5] introduced carrier class, CAMaccelerated solution for SIP DoS defense called "Secure SIP."…”