Hunting SIP Authentication Attacks Efficiently

Nowadays Session Initiation Protocol (SIP) has become the most widely used signaling protocol by the vendors in the Voice over Internet Protocol (VoIP) communication. As the SIP is gaining popularity, open architecture of VoIP often makes SIP vulnerable to so many threats. The paper introduces SIP along with its different security mechanisms with the focus on attack signatures generation technique to identify the malformed SIP messages. It aims to generate various malicious SIP messages and to verify the limitations of the existing classical Intrusion Detection System (IDS) in identifying the malicious messages. Then it sets out to implement an improved detection framework using the rules as regular expression. The experiments were carried out using SER as an open source SIP server, Kphone and X-lite as SIP clients and the SIPSAK as an attacking tool on a testbed architecture which was in a form of virtual environment created with VMware. The platforms used were BackTrack7 and Windows 7. The test was first performed on SNORT, an open source IDS and later by adding the improved detection rules in the configuration file of the SIP server. The successful attacks on the classical attack-signatures generation framework proved that the existing IDSs couldn't identify logical errors in the malicious SIP messages. The proposed detection module identified and rejected all kind of malicious SIP messages with acceptable processing overheads. Moreover the associated signatures database can also be incorporated into other VoIP protocols and open source IDSs like SNORT. This paper has provided the effective mechanism in creating well-formed defense against malicious SIP message attacks to ensure the integrity and security of VoIP subsystems.

The Session Initiation Protocol (SIP) has gained momentum and is being widely used both in the Internet and Next Generation Telecommunications network as the core signaling protocol. SIP operation relies on SIP servers which are responsible for forwarding of SIP messages. It has been shown that the performance of SIP servers is largely degraded during overload conditions due to the built in message retransmission mechanism of SIP. This is an obstacle in wide deployment of SIP for a realistic situation. In this paper we propose a distributed and adaptive window based overload control algorithm, which controls the amount of calls that are forwarded to a downstream SIP server in an attempt to prevent it from being overloaded. Our scheme uses the call establishment delay as a measure of the amount of load on the downstream server and unlike other methods does not rely on explicit feedback. Using simulations we show that our proposed method performs better than a commonly used overload control algorithm and exhibits fast convergence and is stable.

Selective parsing to enhance SIP performance

Abstruct- This paper addresses the design and implementation of Session Initiation Protocol (SIP) server components required for providing Internet telephony services. We first describe a family of SIP servers necessary for Internet telephony, and discuss overall functionality for each SIP server, Then we present our implementations of SIP servers including proxy server and registrar server, along with details of processing routines. We also discuss possible organization of SIP server components for providing Internet telephony services. We will also mention about our experiences on interoperability tests with other products.

The emergence of the Voice over Internet Protocol (VoIP) services requires interconnection between different technologies. In this paper we present an embedded Session Initiation Protocol (SIP) Proxy Gateway (GW) to a Mobile Network with Forward Error Corrections (FEC). Our server registers, locates and forwards the calls of an end user providing intelligent routing for user tracking. In addition, FEC along with a Markov-Chain loss model has been integrated into the server to perform a range of tests. Results prove that under high packet loss rate the embedded SIP server GW improves the speech quality.

Voice over IP (VoIP) has a promise future in communication era. VoIP services can be delivered through different means of protocols. Session Initiation Protocol (SIP) is a common protocol used to initiate, modify and terminate voice call between two parties. One SIP service provider can peer with others through what it called SIP peering. The main aim of SIP peering is not only bring all together but also share other services such as free of charge calls. Technically, SIP peering might be achieved through different scenarios such as Static Direct Peering, Static Indirect Peering or On-demand Peering. Each of such constructs from several functions and relationships which however characterize the peering addressing and routing. In this paper we made a comparative study of Direct and Indirect Static Peering and we found that Indirect Peering is more involved in VoIP industry as it known for its simplicity, efficiency, trusted party and high opportunity of having free voice calls.

To start voice, image, instant messaging, and generally multimedia communication, session communication must begin between two participants. SIP (session initiation protocol) that is an application layer control induces management and terminates this kind of sessions. As far as the independence of SIP from transport layer protocols is concerned, SIP messages can be transferred on a variety of transport layer protocols including TCP or UDP. Mechanism of Retransmission that is embedded in SIP could compensate for the missing packet loss, in case of need. This mechanism is applied when SIP messages are transmitted on an unreliable transmission layer protocol like UDP. Also, while facing SIP proxy with overload, it could cause excessive filling of proxy queue, postpone increase of other contacts, and add to the amount of the proxy overload. In the present work, while using UDP as transport layer protocol, invite retransmission timer (T1) was appropriately regulated and SIP functionality was improved. Therefore, by proposing an adaptive timer of invite message retransmission, attempts were made to improve the time of session initiation and consequently improve the performance. Performance of the proposed SIP was implemented and evaluated by SIPP software in a real network environment and its accuracy and performance were demonstrated.

Internet Protocol (IP) telephony is an alternative to the traditional Public Switched Telephone Networks (PSTN), and the Session Initiation Protocol (SIP) is quickly becoming a popular signaling protocol for VoIP-based applications. SIP is a peer-to-peer multimedia signaling protocol standardized by the Internet Engineering Task Force (IETF), and it plays a vital role in providing IP telephony services through its use of the SIP Proxy Server (SPS), a software application that provides call routing services by parsing and forwarding all the incoming SIP packets in an IP telephony network. SIP Proxy Server Performance closely examines key aspects to the efficient design and implementation of SIP proxy server architecture. Together, a strong design and optimal implementation can enable significant enhancements to the performance characteristics of SPS. Since SPS performance can be characterized by the transaction states of each SIP session, the book analyzes an existing M/M/1-network performance model for SIP proxy servers in light of key performance benchmarks, such as the average response time for processing the SIP calls and the average number of SIP calls in the system. It also presents several other real-world industrial case studies to aid in further optimizations. This book is intended for researchers, practitioners and professionals interested in optimizing SIP proxy server performance. Professionals working on other VoIP solutions will also find the book valuable.

Voice over Internet Protocol (VoIP) over wireless mesh networks (WMNs) is becoming more and more popular due to its significant cost advantage, higher flexibility and wide coverage. One of the most basic requirements of VoIP is that it must provide privacy and security protection for VoIP clients. Unfortunately, little effort is spent on this area. In this paper, we focus on the privacy security of session initiation protocol (SIP) and propose a privacy-aware SIP called PA-SIP to enhance the VoIP privacy security. PA-SIP extends the SIP and applies a subjective logic based reputation mechanism to detect and isolate the insider malicious nodes. Finally, we analyze the PA-SIP in terms of security and performance.

Many companies have transformed their telephone systems into Voice over IP (VoIP) systems. Although implementation is simple, VoIP is vulnerable to different types of attacks. The Session Initiation Protocol (SIP) is a widely used protocol for handling VoIP signaling functions. SIP is unprotected against attacks because it is a text-based protocol and lacks defense against the growing security threats. The Distributed Denial of Service (DDoS) attack is a harmful attack, because it drains resources, and prevents legitimate users from using the available services. In this paper, we formulate detection of DDoS attacks as a classification problem and propose an approach using token embedding to enhance extracted features from SIP messages. We discuss a deep learning model based on Recurrent Neural Networks (RNNs) developed to detect DDoS attacks with low and high-rate intensity. For validation, a balanced real traffic dataset was built containing three attack scenarios with different attack durations and intensities. Experiments show that the system has a high detection accuracy and low detection time. The detection accuracy was higher for low-rate attacks than that of traditional machine learning.

Funding Information: V. CONCLUSIONS This work proposed four classification models based on LSTM RNNs to classify SIP dialogs. The detection probability was evaluated based on experimental data. To detect abnormal SIP dialogs, we have adopted classification features computed from the output of the LSTM RNN model and two different classification schemes were proposed. A semi-supervised scheme is shown to reach higher performance, achieving a detection probability of 99.45%, thus confirming the effective utility of the proposed methodology to detect abnormal SIP sequences in a short period of time. ACKNOWLEDGEMENTS This work was funded by Fundac¸ão para a Ciência e Tecnologia, under the projects InfoCent-IoT (PTDC/EEI-TEL/30433/2017), CoSHARE (PTDC/EEI-TEL/30709/2017), and RFSense (UIDB/50008/2020).

Voice over Internet Protocol (VoIP) is one of the most popular technologies nowadays that facilitate the user by providing different features as instant messages, phone calls, video calls, and voicemails. Basic VoIP protocols were designed to be efficient instead of secure. After numerous attacks on these protocols several solutions were proposed to prevent against these threats. In this paper, we focus on the security of Session Initiation Protocol (SIP) that is used to initiate, modify, and terminate the VoIP sessions. The paper presents the design and implementation of secure layered architecture for SIP, which adds a new layer to the standard SIP layer model and entitled as Security layer. The Security layer provides authentication, authorization, adaptable feature, and secure key exchange, based on our newly designed protocol, named as Session Initiation Protocol using Single Sign-On (SIPSSO). In order to implement the secure layered architecture based on SIPSSO, we have developed an Android Secure Call application and extend the open source Asterisk accordingly. After the designing and implementation phases, we have verified the SIPSSO protocol formally by using an automated security verification tool, Scyther. Our analysis results reveal that by adding Security layer, we ensured protection against different SIP attacks such as Eavesdropping, Man In The Middle (MITM) attack, Message Tampering, Replay attack, Session Teardown, and Spam over Internet Telephony (SPIT).

Recently P2P-SIP (Peer-to-Peer Session Initiation Protocol) has been proposed to improve the scalability and reliability of the traditional SIP (Session Initiation Protocol) networks. However, P2P-SIP makes SIP service unreliable because large-scale P2P-SIP networks are probably more dynamic than traditional SIP networks and the service nodes are very likely to fail or leave the P2P-SIP networks. To deal with this issue, we propose a novel and lightweight algorithm, which replicates SIP transactions information among the nodes in P2P-SIP networks and selects one of the successors of the failed or departed node as the takeover server. Moreover, to reduce the retrieving delay of SIP transactions replicas, we optimize our algorithm by storing these replicas directly in the successors of the failed or departed node. The simulation results demonstrate that our algorithm maintains 99% dialogs correctly in the presence of nodes failure with acceptable overheads over the Internet.

The Session Initiation Protocol (SIP) is designed by taking the establishment of IP telephone network on Internet as the starting point, which has brought new vitality for the IP telephone services. SIP has faced a lot of security threats due to its own characteristics and the application environment. The vulnerability of SIP has been firstly analyzed in this paper. At the same time, based on the theory of identity authentication public key system, a scheme of SIP authentication and key agreement based on identity authentication has been also proposed in this paper. The structure is simple and the application is easy, which has greatly simplified the certificate management and maintenance as well as effectively improved the safety performance of SIP.

This paper explores the opportunities of using not standardized compression codecs while transmitting the voice data over the existing network infrastructure of VoIP (Voice Over Internet Protocol) providers based on SIP (Session Initiation Protocol) in the Internet. Telecommunication networks offer a large set of services aimed at satisfying the ever increasing needs of users. One of them is a VoIP service implemented through network IP/TCP or IP/UDP stack. One of the most important determinants of this process is the need to use data compression. Codec implementation allows you to manage the data compression degree by changing the width of bandwidth usage and voice quality modeling. These features have priority when using VoIP on mobile devices on pre-paid cards such as smartphones where constraints are the size of the packet, the area signal strength in your area and the computing power of the device. Therefore, it is reasonable to develop new technology that provides flexibility in this regard. First of all, implementation of new codecs and ability to put them into VoIP calls according to SIP signaling standards influence on lowering the cost of deployment and then final costs of calls from subscribers located anywhere around the world with access to the Internet even at low bandwidth. The second advantage is the lower network load affecting the reduction of the costs of its maintenance by the owners of the network or service providers.