Title
Utilizing bloom filters for detecting flooding attacks against SIP based services
Abstract
Any application or service utilizing the Internet is exposed to both general Internet attacks and other specific ones. Most of the times the latter are exploiting a vulnerability or misconfiguration in the provided service and/or in the utilized protocol itself. Consequently, the employment of critical services, like Voice over IP (VoIP) services, over the Internet is vulnerable to such attacks and, on top of that, they offer a field for new attacks or variations of existing ones. Among the various threats-attacks that a service provider should consider are the flooding attacks, at the signaling level, which are very similar to those against TCP servers but have emerged at the application level of the Internet architecture. This paper examines flooding attacks against VoIP architectures that employ the Session Initiation Protocol (SIP) as their signaling protocol. The focus is on the design and implementation of the appropriate detection method. Specifically, a bloom filter based monitor is presented and a new metric, named session distance, is introduced in order to provide an effective protection scheme against flooding attacks. The proposed scheme is evaluated through experimental test bed architecture under different scenarios. The results of the evaluation demonstrate that the required time to detect such an attack is negligible and also that the number of false alarms is close to zero.
Year
DOI
Venue
2009
10.1016/j.cose.2009.04.007
Computers & Security
Keywords
Field
DocType
security,flooding attacks,session initiation protocol,session initiation protocol (sip),voice over ip,session initiation protocol sip,denial of service,bloom filter,voice over ip (voip),voice over ip voip,service provider
Internet privacy,Denial-of-service attack,Computer science,Computer security,Server,Computer network,Service provider,Session Initiation Protocol,Signaling protocol,SIP trunking,The Internet,Voice over IP
Journal
Volume
Issue
ISSN
28
7
Computers & Security
Citations 
PageRank 
References 
28
1.08
28
Authors
3
Name
Order
Citations
PageRank
Dimitris Geneiatakis124920.98
Nikos Vrakas2444.10
Costas Lambrinoudakis339346.57