Misuse patterns in VoIP

Abstract

To protect against security attacks, it is necessary to be aware of typical risks and to have a good understanding of how vulnerabilities can be exploited. Security patterns are useful to guide the security design of systems by providing generic solutions that can stop a variety of attacks, but it is not clear to an inexperienced designer what pattern should be applied to stop a specific attack. Additionally, security patterns are not useful for network forensics purposes because they do not emphasize the modus operandi of the attack. As a complement and improvement, we have proposed a new type of pattern, the misuse pattern. This pattern describes, from the point of view of the attacker, how a type of information misuse is performed, analyzes the ways of stopping the attack, and considers how to trace the attack once it has happened. To apply this approach, we need a catalog of misuse patterns. In this paper, we restrict our interest to voice over Internet protocol (VoIP) and we present a set of typical and frequent misuse patterns for VoIP: denial of service (DoS), call interception, theft of service, and call hijacking on VoIP. These patterns could be the start of a comprehensive catalog that would be of practical value to developers, testers, users, and researchers. Published in

Adaptive evidence collection in the cloud using attack scenarios

“…Considering the vulnerabilities associated with specific software products installed allows us to identify concrete attack scenarios and hence specific monitoring activities that collect forensic evidence necessary to demonstrate that these attacks took place. Cloud security reference architectures [24] provide guidance for identifying potential misuse cases [25] arising from the interaction of stakeholders with the system and for detecting a set of security patterns, which include countermeasures to prevent or mitigate those misuse cases. Security patterns also include a general list of components of the cloud architecture, such as VMs and networks, from which forensic evidence regarding a specific misuse pattern can be found.…”

ROSS: Low-Cost Self-Securing VoIP Communication Framework

“…This threat includes eavesdropping and impersonation to support the attack. Session hijacking infiltrates the middle of the communication to gain control over the transmitted data [13]. MITM attack is a renowned act of session hijacking [7][14].…”

Misuse Patterns from the Threat of Modification of Non-Control Data in Network Function Virtualization

“…Although many researchers have explained the possibility of this threat, no one in the literature has used patterns to analyze the threat of non-control data in an NFV system. Patterns have proved convenient to describe the threats in several environments, such as cloud [15], IoT [16], and VoIP [17].…”