Protecting from Cloud-based SIP flooding attacks by leveraging temporal and structural fingerprints

Dassouki, Khaled; Safa, Haïdar; Nassar, Mohamed; Hijazi, Abbas

doi:10.1016/j.cose.2017.08.003

Cited by 11 publications

(7 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Using the temporal features of the SIP state machine and a database of IP-fingerprints to detect and mitigate flooding attacks was proposed in [ 20 ]. At first, the state machine handles each SIP session and generates suitable events.…”

Section: Related Workmentioning

confidence: 99%

Countering DDoS Attacks in SIP Based VoIP Networks Using Recurrent Neural Networks

Nazih

Hifny

Elkilani

et al. 2020

Sensors

View full text Add to dashboard Cite

Many companies have transformed their telephone systems into Voice over IP (VoIP) systems. Although implementation is simple, VoIP is vulnerable to different types of attacks. The Session Initiation Protocol (SIP) is a widely used protocol for handling VoIP signaling functions. SIP is unprotected against attacks because it is a text-based protocol and lacks defense against the growing security threats. The Distributed Denial of Service (DDoS) attack is a harmful attack, because it drains resources, and prevents legitimate users from using the available services. In this paper, we formulate detection of DDoS attacks as a classification problem and propose an approach using token embedding to enhance extracted features from SIP messages. We discuss a deep learning model based on Recurrent Neural Networks (RNNs) developed to detect DDoS attacks with low and high-rate intensity. For validation, a balanced real traffic dataset was built containing three attack scenarios with different attack durations and intensities. Experiments show that the system has a high detection accuracy and low detection time. The detection accuracy was higher for low-rate attacks than that of traditional machine learning.

show abstract

Section: Related Workmentioning

confidence: 99%

Countering DDoS Attacks in SIP Based VoIP Networks Using Recurrent Neural Networks

Nazih

Hifny

Elkilani

et al. 2020

Sensors

View full text Add to dashboard Cite

show abstract

“…The proposed approach in [23] used the temporal features of the SIP state machine and SIP message databases containing IP-fingerprints to detect and mitigate flooding attacks. The state machine handles each SIP session and generates some events.…”

Section: Finite State Machine Approachesmentioning

confidence: 99%

“…It is worth mentioning that almost all the work surveyed uses a simulated dataset, excluding [46,49] where real datasets are used. In [23], the authors tried to mimic a real dataset by using a simulated dataset with one server and nine clients in different regions connected via the internet. The issue of using a dataset with a slight difference between normal and attack messages was tackled in [46].…”

Section: Analysis Of Surveyed Approachesmentioning

confidence: 99%

Survey of Countering DoS/DDoS Attacks on SIP Based VoIP Networks

et al. 2020

View full text Add to dashboard Cite

Voice over IP (VoIP) services hold promise because of their offered features and low cost. Most VoIP networks depend on the Session Initiation Protocol (SIP) to handle signaling functions. The SIP is a text-based protocol that is vulnerable to many attacks. Denial of Service (DoS) and distributed denial of service (DDoS) attacks are the most harmful types of attacks, because they drain VoIP resources and render SIP service unavailable to legitimate users. In this paper, we present recently introduced approaches to detect DoS and DDoS attacks, and classify them based on various factors. We then analyze these approaches according to various characteristics; furthermore, we investigate the main strengths and weaknesses of these approaches. Finally, we provide some remarks for enhancing the surveyed approaches and highlight directions for future research to build effective detection solutions.

show abstract

“…Dassouki et al [17] proposed an approach to discover flooding attacks. They utilized a state machine to create events for SIP sessions.…”

Section: Related Workmentioning

confidence: 99%

Fast Detection of Distributed Denial of Service Attacks in VoIP Networks Using Convolutional Neural Networks

Nazih

Hifny

Elkilani

et al. 2020

IJICIS

View full text Add to dashboard Cite

Voice over Internet Protocol (VoIP) is a recent technology used to transfer media and voice over Internet Protocol (IP). Many organizations moved to VoIP services instead of the traditional telephone systems because of its low cost and variety of introduced services. The Session Initiation Protocol (SIP) is the most used protocol for signaling functions in VoIP networks. It has simple implantation but suffers from less protection against attacks. The Distributed Denial of Service (DDoS) attack is a dangerous attack that preventing legitimate users from using VoIP services and draining their resources. In this paper, we proposed an approach that utilizes deep learning to detect DDoS attacks. The proposed approach uses token embedding to improve the extracted features of SIP messages. Then, Convolutional Neural Network (CNN) was used to detect DDoS attacks with different intensities. Furthermore, a real VoIP dataset that contains different scenarios of attacks was used to evaluate the proposed approach. Our experiments find that the CNN model achieved a high F1 score (99-100%) as another deep learning approach that utilizes Recurrent Neural Network (RNN) but with less detection time. Also, it outperforms another system that depends on classical machine learning in case of low-rate DDoS attacks.

show abstract

Protecting from Cloud-based SIP flooding attacks by leveraging temporal and structural fingerprints

Cited by 11 publications

References 8 publications

Countering DDoS Attacks in SIP Based VoIP Networks Using Recurrent Neural Networks

Countering DDoS Attacks in SIP Based VoIP Networks Using Recurrent Neural Networks

Survey of Countering DoS/DDoS Attacks on SIP Based VoIP Networks

Fast Detection of Distributed Denial of Service Attacks in VoIP Networks Using Convolutional Neural Networks

Contact Info

Product

Resources

About