1 / 23

Detection and Prevention of SIP Flooding Attacks in Voice over IP Networks

Detection and Prevention of SIP Flooding Attacks in Voice over IP Networks. Jin Tang, Yu Cheng and Yong Hao Department of Electrical and Computer Engineering Illinois Institute of Technology ,IEEE INFOCOM 2012 報告人 : 徐裕量 2013/1/29. Outline. Introduction System Model Performance Evaluation

kendall-stevens
Download Presentation

Detection and Prevention of SIP Flooding Attacks in Voice over IP Networks

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Detection and Prevention of SIP Flooding Attacks in Voice over IP Networks Jin Tang, Yu Cheng and Yong Hao Department of Electrical and Computer Engineering Illinois Institute of Technology ,IEEE INFOCOM 2012 報告人:徐裕量 2013/1/29

  2. Outline Introduction System Model Performance Evaluation Discussion Conclusion

  3. Introduction Compared to the traditional public switched telephone network (PSTN), voice over IP (VoIP) is a much more economic technology. But with the tradeoff of more security concerns due to its open infrastructure mainly based on the session initiation protocol (SIP) and the Internet protocol (IP).

  4. Introduction (cont.) The SIP flooding attack is among the most severe of all because it is easy to launch and capable of quickly draining the resources of both networks and nodes.

  5. System Model • VoIP utilizes SIP as the application-layer signaling protocol to establish. • At the transport layer, SIP normally favors the user datagram protocol (UDP) over the transmission control protocol (TCP) due to the simplicity of UDP and the connection oriented nature of SIP itself.

  6. System Model (cont.)

  7. System Model (cont.)

  8. System Model (cont.) • 1) INVITE Flooding: In this attack, thousands of INVITE messages are generated and transmitted to the victim proxy servers which can barely support all of them. • 2) BYE Flooding: Therefore it can be utilized by the attackers to bring down ongoing VoIP phone calls. • 3) Multi-Attribute Flooding: Intelligent attackers can launch different forms of SIP flooding attacks together to the victim proxy servers in a distributed manner.

  9. System Model (cont.) • 1) Sketch: The sketch data structure is a probabilistic data summarization technique.

  10. System Model (cont.) • 2) Hellinger Distance: • To compute HD, suppose that we have two histogram distributions on the same sample space, namely, P = (p1,p2, ⋅ ⋅ ⋅ ,pn) and Q = (q1,q2, ⋅ ⋅ ⋅ , qn). The HD between the two distributions is defined as follow

  11. System Model (cont.)

  12. System Model (cont.)

  13. System Model (cont.)

  14. Performance Evaluation • In the normal condition, the average call generating rate is uniformly distributed from 25 to 75 per second with a mean of 50. The senders of the messages are chosen from 100,000 users.

  15. Performance Evaluation (cont.)

  16. Performance Evaluation (cont.)

  17. Performance Evaluation (cont.)

  18. Performance Evaluation (cont.)

  19. Performance Evaluation (cont.) • when Kincreases, the prevention rate increases accordingly. As Kbecomes larger than the attacker number 300, we achieve almost 100% accuracy.

  20. Performance Evaluation (cont.)

  21. Discussion • Under stealthy attack circumstances, intelligent and patient attackers start with no rush from a low initial rate. • This stealthy attack does not cause sudden directly observable changes in traffic.

  22. Discussion (cont.) • To effectively detect the stealthy flooding attack, we should quickly identify the deviation from normal traffic brought by the attack. • Such thoughts inspire us to resort to wavelet analysis, a signal processing technique which is able to decompose the observed traffic measures into different levels and enable observations on these more detailed levels to identify the deviation.

  23. Conclusion • It propose an online VoIP flooding detection and prevention scheme by integrating two techniques, sketch and Hellinger distance. • The “estimation freeze mechanism” presented shows its ability to both maintain the information about normal behavior under attack and determine the durations of the flooding attacks.

More Related