Session Initiation Protocol Entities Research Articles

Feature engineering for detection of Denial of Service attacks in session initiation protocol

AbstractThe Session Initiation Protocol (SIP) is a text‐based protocol, which defines the messaging between the SIP entities to establish, maintain, and terminate a multimedia session. Because of the text‐ and transaction‐based nature of the SIP protocol, it encounters various types of malformed message and resource depletion attacks. In this paper, we study the security concerns of the SIP‐based systems, and propose a feature set for it. Engineered features are derived from the SIP header fields in real time detecting the deviation of the input traffic from normal state. These features are built at three levels: packet, transaction, and dialog. The designed features can accurately detect the SIP known attacks. Moreover, because we successfully model the state machine of SIP during its normal behavior, we can also identify the unknown attacks. To study the effectiveness of the engineered feature set, we employ them in a sample one‐class support vector machine classifier. We evaluate the engineered features on three different datasets with various types of attack scenarios including resource depletion and authentication and brute force attacks. The impact of these attack scenarios on the designed features are shown in different test cases to demonstrate the effectiveness of our proposed feature set. Copyright © 2014 John Wiley & Sons, Ltd.

SIP Conformance Testing Based on TTCN-2

The session initiation protocol (SIP) is a signaling protocol for Internet telephony, multimedia conferencing, presence, event notification, and instant messaging. With the gaining popularity, more and more SIP implementations have been developed and deployed. How to guarantee the conformance of those SIP implementations is the key point of interconnection and interoperation among them. This paper proposes the test method and architecture for the SIP protocol based on the IPv6 tester system. Tree and tabular combined notation (TTCN-2) is adopted to describe the test suite. With an enhanced reference implementation, the data-processing ability to the original test system has been greatly improved. In the following test prac-tices, some errors have been found in the SIP entities under test. It is proved that the proposed test method and architecture are effective to verify the conformance of the SIP entities, and the result of the conformance test may provide helpful reference to the development of SIP products.

A Peer-to-Peer SIP System based on Service-Aware Transport Overlays

The Session Initiation Protocol (SIP) traditionally establishes and manages its sessions with centralized servers, which have been challenged by issues with TCP/IP networks right from its beginning, for instance, issues with NAT traversal or network congestions. On the other hand, there are peer-to-peer and overlay techniques that potentially can make SIP working better under various network conditions. Overlay networks can provide a good abstraction from the real network, thus hiding the presence of NATs. Some proposals on peer-to-peer SIP have been recently presented. While these proposals attempted to solve a subset of challenges faced by traditional SIP, such as removing the centralized SIP entities, there is to the best of our knowledge no single solution offering a comprehensive view of the peer-to-peer SIP architecture and operation. This paper presents a novel approach for a peer-to-peer SIP system, using overlay techniques for signalling and media transport in the Internet. This system is based on the Ambient Networks Service-Aware Transport Overlay (SATO) system. The proposed system replaces the traditional SIP proxy/registrar function with a distributed lookup mechanism, adding overlay functionality to the SIP signalling and to the RTP traffic. Moreover, different from previous proposals, our approach deliberately places media/packet relays into the SIP/RTP paths, which allows an efficient session management and media communication.

Adapting SIP for application server requirements in 3G networks

The IP Multimedia Subsystem Service Control (ISC) protocol has been adopted by the 3rd Generation Partnership Project (3GPP) in Revision 5 for all signaling in a 3G IP Multimedia Subsystem (IMS) network. While the core protocol is essentially the Session Initiation Protocol (SIP) with extensions, 3GPP has adapted many of the functional elements in slightly different ways. The distinction of the roles (the user agent client [UAC], user agent server [UAS], proxy, redirect, and registrar), as defined in RFC 3261, blurs in the 3G architecture, giving way to more generalized SIP entities such as the proxy, interrogating, and serving call session control functions (P-CSCF, I-CSCF, and S-CSCF) and the SIP application server (AS). In this paper, we suggest that neither of the standard SIP entities, back-to-back user agent (B2BUA) nor proxy, meets the IMS needs of having the SIP AS maintain complete control over the session. Rather, a blend of these two functions is required for a certain class of applications. Using a new abstraction called the pseudo∗∗∗dialog, we show how to augment a B2BUA to provide both the proxy and B2BUA modes of service on a per-call basis.

Transport protocol considerations for session initiation protocol networks

The session initiation protocol (SIP), an application-layer protocol in the Internet protocol (IP) model, is increasingly being used for signaling Internet telephony multimedia sessions. The widespread applicability and use of SIP has engendered the use of diverse transport-layer protocols underneath it (e.g., user datagram protocol [UDP], transmission control protocol [TCP], stream control transmission protocol [SCTP], transport layer security [TLS] over TCP, and TLS over SCTP). In carrier-grade networks, SIP must meet stringent scaling, reliability, and post-dial delay requirements. To some extent, these requirements can be met by optimally transporting SIP. The right choice of a transport protocol is primarily determined by the characteristics of the relevant transport protocols and by how those protocols interplay with individual SIP entities. Additionally, prudent management of transport-layer connections can help lower signaling latencies and facilitate scaling. This paper focuses on SIP transport as a decisive factor in engineering low-latency, scalable, carrier-grade SIP entities. It also presents the concept of SIP connection management and the persistent connection model.

Session initiation protocol: Service residency and resiliency

As the session initiation protocol (SIP) gets deployed, attention invariably needs to be paid to which SIP entities, user agents (UAs), proxies, back-to-back UAs (B2BUA), host services, and to what the impact is on the entity if the service causes it to fail. This paper discusses providing SIP services in terms of individual entities. We address how each of the entities participates in a SIP network and provides services in an individual capacity as well as part of the collective SIP network. © 2003 Lucent Technologies Inc.