Detection and Prevention of SIP Flooding Attacks in Voice over IP Networks

1. Detection and Prevention of SIP Flooding Attacks in Voice over IP Networks Jin Tang, Yu Cheng and Yong Hao Department of Electrical and Computer Engineering Illinois Institute of Technology ,IEEE INFOCOM 2012 報告人:徐裕量 2013/1/29

2. Outline Introduction System Model Performance Evaluation Discussion Conclusion

3. Introduction Compared to the traditional public switched telephone network (PSTN), voice over IP (VoIP) is a much more economic technology. But with the tradeoff of more security concerns due to its open infrastructure mainly based on the session initiation protocol (SIP) and the Internet protocol (IP).

4. Introduction (cont.) The SIP flooding attack is among the most severe of all because it is easy to launch and capable of quickly draining the resources of both networks and nodes.

5. System Model • VoIP utilizes SIP as the application-layer signaling protocol to establish. • At the transport layer, SIP normally favors the user datagram protocol (UDP) over the transmission control protocol (TCP) due to the simplicity of UDP and the connection oriented nature of SIP itself.

6. System Model (cont.)

7. System Model (cont.)

8. System Model (cont.) • 1) INVITE Flooding: In this attack, thousands of INVITE messages are generated and transmitted to the victim proxy servers which can barely support all of them. • 2) BYE Flooding: Therefore it can be utilized by the attackers to bring down ongoing VoIP phone calls. • 3) Multi-Attribute Flooding: Intelligent attackers can launch different forms of SIP flooding attacks together to the victim proxy servers in a distributed manner.

9. System Model (cont.) • 1) Sketch: The sketch data structure is a probabilistic data summarization technique.

10. System Model (cont.) • 2) Hellinger Distance: • To compute HD, suppose that we have two histogram distributions on the same sample space, namely, P = (p1,p2, ⋅ ⋅ ⋅ ,pn) and Q = (q1,q2, ⋅ ⋅ ⋅ , qn). The HD between the two distributions is defined as follow

11. System Model (cont.)

12. System Model (cont.)

13. System Model (cont.)

14. Performance Evaluation • In the normal condition, the average call generating rate is uniformly distributed from 25 to 75 per second with a mean of 50. The senders of the messages are chosen from 100,000 users.

15. Performance Evaluation (cont.)

16. Performance Evaluation (cont.)

17. Performance Evaluation (cont.)

18. Performance Evaluation (cont.)

19. Performance Evaluation (cont.) • when Kincreases, the prevention rate increases accordingly. As Kbecomes larger than the attacker number 300, we achieve almost 100% accuracy.

20. Performance Evaluation (cont.)

21. Discussion • Under stealthy attack circumstances, intelligent and patient attackers start with no rush from a low initial rate. • This stealthy attack does not cause sudden directly observable changes in traffic.

22. Discussion (cont.) • To effectively detect the stealthy flooding attack, we should quickly identify the deviation from normal traffic brought by the attack. • Such thoughts inspire us to resort to wavelet analysis, a signal processing technique which is able to decompose the observed traffic measures into different levels and enable observations on these more detailed levels to identify the deviation.

23. Conclusion • It propose an online VoIP flooding detection and prevention scheme by integrating two techniques, sketch and Hellinger distance. • The “estimation freeze mechanism” presented shows its ability to both maintain the information about normal behavior under attack and determine the durations of the flooding attacks.