A Privacy-Preserving Entropy-Driven Framework for Tracing DoS Attacks in VoIP

Abstract

Abstract-Network audit trails, especially those composed of application layer data, can be a valuable source of information regarding the investigation of attack incidents. Nevertheless, the analysis of log files of large volume is usually both complex (slow) and privacy-neglecting. Especially, when it comes to VoIP, the literature on how audit trails can be exploited to identify attacks remains scarce. This paper provides an entropy-driven, privacypreserving, and practical framework for detecting resource consumption attacks in VoIP ecosystems. We extensively evaluate our framework under various attack scenarios involving single and multiple assailants. The results obtained show that the proposed scheme is capable of identifying malicious traffic with a false positive alarm rate up to 3.5%.

Anomaly‐based DoS detection and prevention in SIP networks by modeling SIP normal traffic

“…This method uses defined transaction state machines in SIP standard and can only detect different DoS attacks during transactions. In previous studies, 33,34 the authors used log files and audit trails to detect improper use of VoIP network. The privacy and huge size of users' information encouraged the authors to apply hash functions for anonymity purposes.…”

Using group anonymity to hide the identity of VoIP mobile users communicating over hybrid networks while preserving quality of service

“… showed examples of attacks detected over SIP‐based VoIP, while Tsiatsikas et al . proposed a design to trace DoS attacks in VoIP, but does not protect users' identities.…”

Ανίχνευση Και Πρόληψη Επιθέσεων Άρνησης Εξυπηρέτησης Στα Πρωτόκολλα SIP Και SDP

“…Precisely, a first contribution of this PhD thesis builds over the idea proposed in [129], that is, the use of Entropy theory to detect abnormalities in raw application data. Specifically, through extensive experimentation, we extend, calibrate and throughly assess the effectiveness of the initial idea, thus offering a complete formalized framework that can be used to trace and detect application layer DDoS attacks in SIP networks.…”

“…A year later, Tsiatsikas et al [34] proposed an entropy-driven framework for battling against DoS attacks in SIP. In essence, the authors extended their previous work introduced in [129]. As the authors stated, their scheme operates both as a standalone application and a software module destined to SIP proxies.…”

“…On the other hand, data coming from the application layer are usually rich of information that can be processed towards identifying security incidents. The authors in [129] have identified this potential in theoretical level, but unfortunately the results they provide solely stem from offline analysis using predetermined patterns of SIP traffic.…”