Design, Implementation, and Performance of a Load Balancer for SIP Server Clusters

Recently P2P-SIP (Peer-to-Peer Session Initiation Protocol) has been proposed to improve the scalability and reliability of the traditional SIP (Session Initiation Protocol) networks. However, P2P-SIP makes SIP service unreliable because large-scale P2P-SIP networks are probably more dynamic than traditional SIP networks and the service nodes are very likely to fail or leave the P2P-SIP networks. To deal with this issue, we propose a novel and lightweight algorithm, which replicates SIP transactions information among the nodes in P2P-SIP networks and selects one of the successors of the failed or departed node as the takeover server. Moreover, to reduce the retrieving delay of SIP transactions replicas, we optimize our algorithm by storing these replicas directly in the successors of the failed or departed node. The simulation results demonstrate that our algorithm maintains 99% dialogs correctly in the presence of nodes failure with acceptable overheads over the Internet.

The Session Initiation Protocol (SIP) has gained momentum and is being widely used both in the Internet and Next Generation Telecommunications network as the core signaling protocol. SIP operation relies on SIP servers which are responsible for forwarding of SIP messages. It has been shown that the performance of SIP servers is largely degraded during overload conditions due to the built in message retransmission mechanism of SIP. This is an obstacle in wide deployment of SIP for a realistic situation. In this paper we propose a distributed and adaptive window based overload control algorithm, which controls the amount of calls that are forwarded to a downstream SIP server in an attempt to prevent it from being overloaded. Our scheme uses the call establishment delay as a measure of the amount of load on the downstream server and unlike other methods does not rely on explicit feedback. Using simulations we show that our proposed method performs better than a commonly used overload control algorithm and exhibits fast convergence and is stable.

Selective parsing to enhance SIP performance

Abstruct- This paper addresses the design and implementation of Session Initiation Protocol (SIP) server components required for providing Internet telephony services. We first describe a family of SIP servers necessary for Internet telephony, and discuss overall functionality for each SIP server, Then we present our implementations of SIP servers including proxy server and registrar server, along with details of processing routines. We also discuss possible organization of SIP server components for providing Internet telephony services. We will also mention about our experiences on interoperability tests with other products.

To start voice, image, instant messaging, and generally multimedia communication, session communication must begin between two participants. SIP (session initiation protocol) that is an application layer control induces management and terminates this kind of sessions. As far as the independence of SIP from transport layer protocols is concerned, SIP messages can be transferred on a variety of transport layer protocols including TCP or UDP. Mechanism of Retransmission that is embedded in SIP could compensate for the missing packet loss, in case of need. This mechanism is applied when SIP messages are transmitted on an unreliable transmission layer protocol like UDP. Also, while facing SIP proxy with overload, it could cause excessive filling of proxy queue, postpone increase of other contacts, and add to the amount of the proxy overload. In the present work, while using UDP as transport layer protocol, invite retransmission timer (T1) was appropriately regulated and SIP functionality was improved. Therefore, by proposing an adaptive timer of invite message retransmission, attempts were made to improve the time of session initiation and consequently improve the performance. Performance of the proposed SIP was implemented and evaluated by SIPP software in a real network environment and its accuracy and performance were demonstrated.

Nowadays Session Initiation Protocol (SIP) has become the most widely used signaling protocol by the vendors in the Voice over Internet Protocol (VoIP) communication. As the SIP is gaining popularity, open architecture of VoIP often makes SIP vulnerable to so many threats. The paper introduces SIP along with its different security mechanisms with the focus on attack signatures generation technique to identify the malformed SIP messages. It aims to generate various malicious SIP messages and to verify the limitations of the existing classical Intrusion Detection System (IDS) in identifying the malicious messages. Then it sets out to implement an improved detection framework using the rules as regular expression. The experiments were carried out using SER as an open source SIP server, Kphone and X-lite as SIP clients and the SIPSAK as an attacking tool on a testbed architecture which was in a form of virtual environment created with VMware. The platforms used were BackTrack7 and Windows 7. The test was first performed on SNORT, an open source IDS and later by adding the improved detection rules in the configuration file of the SIP server. The successful attacks on the classical attack-signatures generation framework proved that the existing IDSs couldn't identify logical errors in the malicious SIP messages. The proposed detection module identified and rejected all kind of malicious SIP messages with acceptable processing overheads. Moreover the associated signatures database can also be incorporated into other VoIP protocols and open source IDSs like SNORT. This paper has provided the effective mechanism in creating well-formed defense against malicious SIP message attacks to ensure the integrity and security of VoIP subsystems.

Overload occurs in Session Initiation Protocol (SIP) networks when SIP servers have insufficient resources to handle all the SIP messages they receive. Even though the SIP protocol provides a limited overload control mechanism through its 503 (Service Unavailable) response code, SIP servers are still vulnerable to overload. This document defines the behavior of SIP servers involved in overload control and also specifies a loss-based overload scheme for SIP.

Funding Information: V. CONCLUSIONS This work proposed four classification models based on LSTM RNNs to classify SIP dialogs. The detection probability was evaluated based on experimental data. To detect abnormal SIP dialogs, we have adopted classification features computed from the output of the LSTM RNN model and two different classification schemes were proposed. A semi-supervised scheme is shown to reach higher performance, achieving a detection probability of 99.45%, thus confirming the effective utility of the proposed methodology to detect abnormal SIP sequences in a short period of time. ACKNOWLEDGEMENTS This work was funded by Fundac¸ão para a Ciência e Tecnologia, under the projects InfoCent-IoT (PTDC/EEI-TEL/30433/2017), CoSHARE (PTDC/EEI-TEL/30709/2017), and RFSense (UIDB/50008/2020).

Extended flow records with application layer (L7) information allow for detection of various types of malicious traffic. Voice over IP (VoIP) is an example of technology that works on L7 and many attacks against it cannot be reliably detected using just basic flow information. Session Initiation Protocol (SIP), which is commonly used for VoIP signalling, is a frequent target of many types of attacks. This paper proposes and evaluates a novel algorithm for near real time detection of username scanning and password guessing attacks on SIP servers. The detection is based on analysis of L7 extended flow records.

The Session Initiation Protocol (SIP) is an application-layer control protocol for creating, modifying and terminating multimedia sessions. An open issue is the control of overload that occurs when a SIP server lacks sufficient CPU and memory resources to process all messages. We prove that the problem of overload control in SIP network with a set of n servers and limited resources is in the form of NP-hard. This paper proposes a Load-Balanced Call Admission Controller (LB-CAC), based on a heuristic mathematical model to determine an optimal resource allocation in such a way that maximizes call admission rates regarding the limited resources of the SIP servers. LB-CAC determines the optimal "call admission rates" and "signaling paths" for admitted calls along optimal allocation of CPU and memory resources of the SIP servers through a new linear programming model. This happens by acquiring some critical information of SIP servers. An assessment of the numerical and experimental results demonstrates the efficiency of the proposed method.

A Session Initiation Protocol (SIP) server may be overloaded by emergency-induced call volume, “American Idol” style flash crowd effects or denial of service attacks. The SIP server overload problem is interesting especially because the costs of serving or rejecting a SIP session can be similar. For this reason, the built-in SIP overload control mechanism based on generating rejection messages cannot prevent the server from entering congestion collapse under heavy load. The SIP overload problem calls for a pushback control solution in which the potentially overloaded receiving server may notify its upstream sending servers to have them send only the amount of load within the receiving server’s processing capacity. The pushback framework can be achieved by either a rate-based feedback or a window-based feedback. The centerpiece of the feedback mechanism is the algorithm used to generate load regulation information. We propose three new window-based feedback algorithms and evaluate them together with two existing rate-based feedback algorithms. We compare the different algorithms in terms of the number of tuning parameters and performance under both steady and variable load. Furthermore, we identify two categories of fairness requirements for SIP overload control, namely, user-centric and provider-centric fairness. With the introduction of a new double-feed SIP overload control architecture, we show how the algorithms can meet those fairness criteria.KeywordsSession Initiation ProtocolSession Initiation Protocol ServerFeedback AlgorithmSession Initiation Protocol MessageOverload ControlThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

The emergence of the Voice over Internet Protocol (VoIP) services requires interconnection between different technologies. In this paper we present an embedded Session Initiation Protocol (SIP) Proxy Gateway (GW) to a Mobile Network with Forward Error Corrections (FEC). Our server registers, locates and forwards the calls of an end user providing intelligent routing for user tracking. In addition, FEC along with a Markov-Chain loss model has been integrated into the server to perform a range of tests. Results prove that under high packet loss rate the embedded SIP server GW improves the speech quality.

The Session Initiation Protocol (SIP) is an application-layer control protocol used to establish and terminate calls that are deployed globally. A flood of SIP INVITE packets sent by an attacker causes a Telephony Denial of Service (TDoS) incident, during which legitimate users are unable to use telephony services. Legacy TDoS defense is typically implemented as network appliances and not sufficiently deployed to enable early detection. To make TDoS defense more widely deployed and yet affordable, this paper presents TDoSD@DP where TDoS detection and mitigation is programmed at the data plane so that it can be enabled on every switch port and therefore serves as distributed SIP sensors. With this approach, the damage is isolated at a particular switch and bandwidth saved by not sending attack packets further upstream. Experiments have been performed to track the SIP state machine and to limit the number of active SIP session per port. The results show that TDoSD@DP was able to detect and mitigate ongoing INVITE flood attack, protecting the SIP server, and limiting the damage to a local switch. Bringing the TDoS defense function to the data plane provides a novel data plane application that operates at the SIP protocol and a novel approach for TDoS defense implementation.

SIP has been used to develop many kinds of SIP service, such as instant messaging, conference and presence, and these various services are being bundled to one application. NAT traversal has long been identified as a large problem when considered in the context of the session initiation protocol (SIP). The problem is further confused by the variety of NATs that are available in the market place today and the large number of potential deployment scenarios. In this paper, we suggest an ALG which operates inside NAT for traversal of SIP transactions.

Chapter 14 - Securing Multimedia Communications