Application of Gaussian Estimation for Devising Reliable Vulnerability Assessment on SIP-based VoIP Infrastructure

The Session Initiation Protocol (SIP) is an application-layer protocol commonly used in VoIP for communication over the Internet. In this paper we describe a method to assess a particular kind of vulnerability of SIP implementation so that we could gain insights into its robustness. We used PROTOS as a tool to carry out exception element injection into SIP INVITE method and test it against a SIP implementation in our lab. The purpose of this test is to evaluate implementation level security and robustness of Session Initialization Protocol (SIP). During our test, we noticed that the choice of “wait time” could significantly change the outcome of the assessment. Yet exhaustive trials for finding the optimal wait time are too laborious and expensive. Consequently, we adopted a Gaussian estimation approach for finding the appropriate choice of “wait time.” In this paper we describe the estimation approach and how it is applied to obtain reliable experimental results.