A Novel Approach for Evaluating and Detecting Low Rate SIP Flooding Attack

Abstract

Voice over Internet protocol (VoIP) is continuously evolving and changing the face of business telephony. The Session Initiation Protocol (SIP) is a widely used standard in VoIP communications to setup and tear down phone calls. Low rate Denial-of Service (DoS) attack recently emerged as the greatest threat to enterprise VoIP systems. Such attacks are difficult to detect and capable of discovering vulnerabilities in protocols with low rate traffic. In this paper we aim to p rovide a novel low rate SIP flooding detection scheme using area under curve of monitored dynamic SIP traffic with classification of SIP flooding attacks and its impact on SIP server under low rate DoS attack. Compared to the other detection system our technique achieves advantages of accuracy, fast, light weight, and flexibility to deal with DDoS attack detection. Experimental results show the effectiveness of the scheme.