Anomaly‐based DoS detection and prevention in SIP networks by modeling SIP normal traffic

Abstract

Due to the various features of Voice over Internet Protocol (VoIP), this technology has attracted the attention of many users in comparison with the traditional telephony system. However, with the growth of this technology, the security issues and protection of its users against different kinds of threats have been raised as an essential requirement. Session Initiation Protocol is a predominant protocol to initiate and terminate multimedia sessions in VoIP networks that provide simplicity and text-based features. Despite its mentioned advantages, these features impose several vulnerabilities on VoIP networks. Denial of Service attack, as one of the most common attacks against VoIP networks, is also a noted security issue in the Internet Protocol platforms. In such attacks, the attacker tries to prevent service from authorized users by consuming server resources. These attacks can be launched by sending out-of-sequence messages, malformed messages, and flooding different kinds of messages. In this study, a new anomaly-based method is presented for detection and prevention of these attacks. Normal traffic of a VoIP network is modeled by making a finite state machine, which is used for attack detection besides other proposed modules. Furthermore, a whitelist method is implemented using Bloom data structure for attack prevention. The proposed method is completely implemented and tested using different test scenarios. The obtained results show that by using proposed method, attacks can be detected more accurately with lower false ratios and delay in comparison with the existing methods. KEYWORDSVoIP network, SIP security, DoS attacks, finite state machine (FSM)

Research on Network Traffic Anomaly Detection Method Based on Python

“…The types of abnormal network traffic mainly include Alpha Anomaly, DDos, Port Scan, Network Scan, Worms and Flash Crowd [4][5]. Common network attacks can be divided into three categories: first, reconnaissance and tracking attacks: stealing all kinds of information of the target computer; Second, access attack: using system vulnerabilities to gain host control rights; The third is to refuse service.…”

Survey of Countering DoS/DDoS Attacks on SIP Based VoIP Networks

“…Hosseinpour et al [22] used normal SIP calls to create an FSM. The number of messages in state transitions were calculated during the day, and an average of time differences between FSM states was extracted.…”

“…-Features are extracted from SIP messages and server logs. Most of the surveyed approaches have classified the SIP messages into normal or malicious while others have determined the attack severity (e.g., [22]) or the intensity of the attacks (e.g., [49]). In addition, only the proposed approach in [21] has identified the attackers from legitimate users.…”

“…Feature extraction is an important process in ML approaches. The majority of the surveyed ML approaches extracted features from SIP headers and haven't used other resources such as server log files [40] or CDR [22]. In addition, some of these approaches such as [42,49] have calculated features over a group of SIP messages to capture the correlation between messages, while others such as [46,48] have extracted features over one by one SIP messages to achieve faster detection time.…”