A Study about DDoS Attacks in SIP Environments

Modern all-IP networks, which transfer telephony, multimedia and data use mainly as signalling protocol the Session Initiation Protocol (SIP). These networks are exposed to various types of attacks, and among them, a DDoS attack can result particularly dangerous, because it can be directed against the SIP signalling system. A shield can be implemented only after the detection of an attack, hence, it is important to implement a fast and reliable method for the detection of an attack. In this paper, we propose a new method to resolve the problem of detection of flood-based DDoS attacks during a SIP session. The method we propose is based on non-parametric CUSUM theory and uses a sensor to analyze inter-arrival times of incoming flows jointly to a packet analyzer. This last is used to extract sensible data from the received SIP messages. Particularly, we assume that the flow of SIP requests is Poisson distributed.