Session Initiation Protocol Networks Research Articles

A Novel Approach for Efficient Mitigation against the SIP-Based DRDoS Attack

Voice over Internet Protocol (VoIP) and its underlying Session Initiation Protocol (SIP) are widely deployed technologies since they provide an efficient and fast means of both voice and data communication over a single network. However, in spite of their advantages, they also have their security threats due to the inherent vulnerabilities in the underlying Internet Protocol (IP) that can potentially be exploited by hackers. This study introduces a novel defense mechanism to effectively combat advanced attacks that exploit vulnerabilities identified in some less-known features of SIP. The SIP-DRDoS (SIP-based distributed reflection denial of service) attack, which can survive the existing security systems, is an advanced attack that can be performed on an SIP network through the multiplication of legitimate traffic. In this study, we propose a novel defense mechanism that consists of statistics, inspection, and action modules to mitigate the SIP-DRDoS attack. We implement the SIP-DRDoS attack by utilizing our SIP-based audit and attack software in our VoIP/SIP security lab environment that simulates an enterprise-grade SIP network. We then utilize our SIP-based defense tool to realize our novel defense mechanism against the SIP-DRDoS attack. Our experimental results prove that our defense approach can do a deep packet analysis for SIP traffic, detect SIP flood attacks, and mitigate them by dropping attack packets. While the SIP-DRDoS attack with around 1 Gbps of traffic dramatically escalates the CPU (central processing unit) usage of the SIP server by up to 74%, our defense mechanism effectively reduces it down to 17% within 6 min after the attack is initiated. Our approach represents a significant advancement over the existing defense mechanisms and demonstrates the potential to effectively protect VoIP systems against SIP-based DRDoS attacks.

Analytical Model to Create Proxy Server Sessions in Multimedia Networks

One of the most popular and widely applied protocols on multimedia networks is the Session Initiation Protocol (SIP) to create, modify, and terminate the sessions. SIP is the platform of Next Generation Networks (NGN). In this way, SIP should be able to respond to the needs of such a largely-used network. One of the major problems in SIP networks is overload. This challenge creates a sharp drop in quality of service for NGN users. In this regard, many studies have been conducted on the effectiveness of this protocol, especially under overload. A new analytical model is developed that prioritizes the SIP message processing. An analytical approach is proposed based on the Mean Value Analysis (MVA) algorithm in queue theory. Considering some appropriate assumptions customizing MVA as to implement this proposed model and to cope with the limitations of the MVA is highly essential. The output of the analytical model is compared with the standard SIP model obtained from the simulator and the results confirm that prioritizing original messages would enhance the SIP performance at different load conditions. Prioritization of original messages is advantageous, and outperforms the normal SIP. Nevertheless, prioritizing the repeated messages not only has no advantage, but also its performance is less than the normal SIP.

Design of P2P-SIP System Network Structure Based on JXTA

Session Initiation Protocol (SIP) is one of the most important signaling connection protocols in the field of VoIP (Voice over Internet Protocol). However, the existing SIP network has some problems such as manual configuration, difficult maintenance and poor scalability. With the development of P2P (Peer-to-Peer) technology, the combination of SIP and P2P has become a trend. JXTA is an open peer-to-peer platform, which provides basic application services for building P2P network. The topic chooses JXTA development platform to build P2P network, and then constructs SIP soft terminal on it. Based on the in-depth study of JXTA structured network and SIP protocol, a P2P SIP system is designed and implemented. The system can maintain normal SIP communication without maintaining the central server. In this paper, the detailed design and implementation process of P2P-SIP system are given, including node join and leave, user join, user search and session establishment. This paper focuses on the implementation process of user search, that is, the collaborative process of discovery service, resolution service, aggregation service and endpoint routing service. Finally, the feasibility of the system is verified by functional test.

SIP Network Secure Communication Model Based on Improved SIP Protocol

The hot topics of session initiation protocol (SIP) authentication are mainly hypertext transfer protocol (HTTP) digest authentication mechanism and public-key cryptography standards (PKI) authentication mechanism. Among them, the PKI authentication mechanism encounters problems such as long encryption and decryption time and difficult actual deployment. Aiming at the shortcomings of the existing identity authentication mechanism of SIP, start with the chaotic sequence generated by chaotic equations, the dynamic password generation is optimised during the authentication process. A SIP security authentication mechanism based on chaotic equations is proposed. Firstly, improved security authentication scheme is applied in the video intercom system, then the chaotic signal generator on the microcontroller is designed, and finally the improved security authentication scheme is applied into the system. The results show that the system can realise all the functions at design time based on the improved SIP certification.

Signaling Packet Aggregation and Compression in SIP Network: Modeling and Performance Evaluation

Recent development in communications have increased the demand of internet protocol (IP)-based multimedia conferencing services. Session initiation protocol (SIP) is a signaling protocol used for providing group communication in IP-based next generation network. The conferencing frameworks proposed by Internet Engineering Task Force working groups has limited scalability due to the centralized management of conference control by a single server. In order to overcome this limitation, we propose multiple SIP packet aggregation and compression of common header part of each aggregated packet process. This mechanism increases the bandwidth utilization and processing capability of conference server. A queueing model is developed to describe the process of packet aggregation (PA) and compression at the edge proxy. Using the proposed queueing model, the steady-state probability distribution of the queue length is derived and the average packet transmission delay is obtained. We show the trade-off between the overhead gain and delay. Based on the analytical results, the maximum frame size is optimized for which the average delay of a packet transmission is minimum. A discrete event simulation is performed using network simulator 2 to implement PA and compression mechanism in a SIP network. Further, performance measures are numerically obtained from the simulation results. The simulation results discussed upon the key performance metrics for signaling protocols defined by the International Telecommunication Union (ITU) Telecommunication Standardization Sector (ITU-T E.721).

An intelligent cyber security system against DDoS attacks in SIP networks

Distributed Denial of Services (DDoS) attacks are among the most encountered cyber criminal activities in communication networks that can result in considerable financial and prestige losses for the corporations or governmental organizations. Therefore, autonomous detection of a DDoS attack and identification of its sources is essential for taking counter-measures. This study proposes an intelligent security system against DDoS attacks in communication networks that is composed of two components: A monitor for detection of DDoS attacks and a discriminator for detection of users in the system with malicious intents. A novel adaptive real time change-point model that tracks the changes in Mahalanobis distances between sampled feature vectors in the monitored system accounts for possible DDoS attacks. A clustering model that runs over the similarity scores of behavioral patterns between the users is used to segregate the malicious from the innocent. The proposed model is deployed over a simulated telephone network that uses a Session Initiation Protocol (SIP) server. The performance of the models are evaluated on data generated by this high throughput simulation environment.

A Bayesian change point model for detecting SIP-based DDoS attacks

Session Initiation Protocol (SIP), as one the most common signaling mechanism for Voice Over Internet Protocol (VoIP) applications, is a popular target for the flooding-based Distributed Denial of Service (DDoS) attacks. In this paper, we propose a DDoS attack detection framework based on the Bayesian multiple change model, which can detect different types of flooding attacks. Additionally, we propose a probabilistic SIP network simulation system that provides a test environment for network security tools.

On fluid‐flow modeling of priority based request scheduling for finite buffer SIP server

SummaryWith the widespread deployments of voice‐over‐internet protocol services, the existing session initiation protocol (SIP) design cannot scale up for large network sizes. Events triggering a demand burst or a server slowdown can cause SIP server overload, overload propagation, and crash, thus bringing down the whole SIP network. Since the SIP retransmission mechanism exacerbates the overload condition, existing models created for a stable SIP system cannot be effectively used to analyze an overloaded server. In this paper, we propose a fluid‐flow model to characterize the behavior of the finite buffer SIP server equipped with priority‐based request scheduling mechanism (PRSM). The model for the PRSM uses primary and secondary queues for the original request messages and the retransmitted requests, respectively. The performance metrics, namely, the failed call attempts and the response delay from sending INVITE request until receiving a 100‐Trying response, are derived using the arrival time‐slot tracking and the removal processes of the proposed fluid‐flow model. We conducted test cases under the heavy traffic conditions, where the overload is caused by bulk and bursty arrivals or server slowdown. The numerical results closely match with the simulation results for all experiments, indicating that the proposed model can accurately capture the dynamic behavior of an SIP server with the PRSM. The experiments demonstrate that the number of failed call attempts is close to 0 and the mean response delay is kept constant around 175 ms for the PRSM when the buffer size is higher than 1K while both metrics are significantly higher for the conventional SIP.

Overload management with regard to fairness in session initiation protocol networks by holonic multiagent systems

SummarySession initiation protocol (SIP) is a widely used standard protocol for multimedia applications and IP multimedia subsystems. Internet protocol multimedia subsystem was introduced by the 3GGP signaling foundation as part of a set of next generation network architectures. Despite having useful practical features, SIP does not have suitable mechanisms to handle overload. This challenge creates a sharp drop in quality of service for next generation network users. Because a distributed SIP network is a complex system composed of subsystems interacting with one another, multiagent system is an appropriate method to model network interactions and to solve overload in SIP networks. In this paper, holonic organization is applied to reduce the multiagent system complexity in modeling a large SIP network. Holonic organization is a hierarchical structure in which each holon covers a geographical area of the SIP network at the first level. At the second level, upper‐level holons control the first‐level holons, and so on. Overload control is achieved by communication and the exchange of knowledge between the intelligent holons. Experimental results show that the proposed method prevents overload in the SIP network. The method also increases total throughput, reduces delay, and considers fairness in the SIP network.

Local and distributed SIP overload control solution improving sustainability of SIP networks

SummaryCarriers have adopted session initiation protocol (SIP) in their next generation networks. Providing carrier‐grade service requires high availability in times of component failures, avalanche restart, flash crowds and denial of service attacks, which cause overload on SIP servers. Throughput of SIP servers is largely degraded during overload. We propose an SIP overload control (SIP‐OC) solution for local and remote situations, working in hop‐by‐hop and end‐to‐end modes. Our local SIP‐OC method uses a cross‐layer approach with negligible performance impact, while the implicit nature of our remote SIP‐OC allows detection of sophisticated overload conditions such as those caused by non‐SIP entities. Our remote SIP‐OC uses transaction response time as the basis for implicit overload detection. Coupling our local and remote SIP‐OC schemes, we show that the range of ‘sustainable’ overload that can be imposed on the system improves significantly. Moreover, incorporating a 2‐means filtering mechanism into our SIP‐OC scheme makes it perform well under packet‐loss. We also show that our proposed solution is robust to network latency and SIP server capacity fluctuations. All of our results are obtained from experiments over SIP testbeds including an experimental IP multimedia subsystem. Copyright © 2016 John Wiley & Sons, Ltd.

A dynamic distributed overload control mechanism in SIP networks with holonic multi-agent systems

Nowadays, session initiation protocol (SIP) is the most important application layer protocol for multi-media to create, modify, and terminate the sessions. SIP is the platform of next generation networks. In this way, SIP should be able to respond to the needs of such a largely-used network. One of the major problems in SIP networks is overload. The basic mechanism embedded in SIP cannot appropriately resolve the due problem by purely rejecting requests, which may cause collapse in network. Many methods have been proposed to overcome overload in SIP, among which, multi-agent systems are new agent-based and increasingly growing approaches. Multi-agent system is a powerful tool to model and develop the complex large scale distributed systems. In SIP network, each agent may point out to a server which is in interaction with the others. As a result, a distributed and complex system is simply modeled. The due complexity can be reduced by holonic organization. In this paper, SIP network is divided into geographical areas in which each holon controls an area. The entire network is controlled in hierarchical structure of holons. Holonics structure can be dynamically changed based on the circumstances parameters and the status of the network during execution. Holons implement an end-to-end window-based method. This method offers an appropriate window size for edge servers to control load from the beginning of the network and prevent network overload. The simulation results confirm improved throughput, as well as better reduced call setup delay, rapid response to change and fairness.

Probe-based end-to-end overload control for networks of SIP servers

The Session Initiation Protocol (SIP) has been adopted by the IETF as the control protocol for creating, modifying and terminating multimedia sessions. Overload occurs in SIP networks when SIP servers have insufficient resources to handle received messages. Under overload, SIP networks may suffer from congestion collapse due to current ineffective SIP overload control mechanisms. This paper introduces a probe-based end-to-end overload control (PEOC) mechanism, which is deployed at the edge servers of SIP networks and is easy to implement. By probing the SIP network with SIP messages, PEOC estimates the network load and controls the traffic admitted to the network according to the estimated load. Theoretic analysis and extensive simulations verify that PEOC can keep high throughput for SIP networks even when the offered load exceeds the capacity of the network. Besides, it can respond quickly to the sudden variations of the offered load and achieve good fairness.

Applying control theoretic approach to mitigate SIP overload

The Session Initiation Protocol (SIP) retransmission mechanism is designed to maintain reliable transmission over lossy or faulty network conditions. However, the retransmission can amplify the traffic overload faced by the SIP servers. In this paper, by modeling the interaction between an overloaded downstream server and its upstream server as a feedback control system, we propose two Proportional-Integral (PI) control algorithms to mitigate the overload by regulating the retransmission rate in the upstream server. We provide the design guidelines for both overload control algorithms to ensure the system stability. Our OPNET® simulation results demonstrate that: (1) without the control algorithm applied, the overload at a downstream server may propagate to its upstream servers and cause widespread network failure; (2) in case of short-term overload, both proposed feedback control solutions can mitigate the overload effectively without rejecting calls or reducing resource utilization, thus avoiding the disadvantages of existing overload control solutions for SIP networks.

Modelling chaotic behaviour of SIP retransmission mechanism

The Session Initiation Protocol (SIP) retransmission mechanism can cause SIP network collapse with short-term overload. In this paper, we investigate with a fluid modelling approach the chaotic behaviour of the SIP retransmission mechanism in SIP networks. We capture the complex correlation structure in SIP systems through a detailed and novel queuing analysis. To dimension a buffer size which can avoid unnecessary message drop in a SIP server, we develop a sufficient condition for a stable SIP system analytically based on our fluid model. We also apply our fluid model to the simulation of a complex SIP system. We compare the simulation results achieved through our fluid models with those based on OPNET® event-driven approach to demonstrate the validity of our approach.

A distributed end-to-end overload control mechanism for networks of SIP servers

The Session Initiation Protocol (SIP) is an application-layer control protocol standardized by the IETF for creating, modifying and terminating multimedia sessions. With the increasing use of SIP in large deployments, the current SIP design cannot handle overload effectively, which may cause SIP networks to suffer from congestion collapse under heavy offered load. This paper introduces a distributed end-to-end overload control (DEOC) mechanism, which is deployed at the edge servers of SIP networks and is easy to implement. By applying overload control closest to the source of traffic, DEOC can keep high throughput for SIP networks even when the offered load exceeds the capacity of the network. Besides, it responds quickly to the sudden variations of the offered load and achieves good fairness. Theoretic analysis and extensive simulations verify that DEOC is effective in controlling overload of SIP networks.

Modeling and design of a Session Initiation Protocol overload control algorithm

Recent collapses of Session Initiation Protocol (SIP) servers indicate that the built-in SIP overload control mechanism cannot mitigate overload effectively. In this paper, we propose a new SIP overload control algorithm by introducing a novel analytical approach to model the dynamic behavior of a SIP network where each server has a finite buffer. Three key breakthroughs of our modeling approach are the formulations of the message loss process, message retransmission process, and the complex departure process through detailed analysis. Our modeling results indicate that retransmissions triggered by the queuing delay are redundant, thus we propose a feedback control mechanism that regulates the retransmission message rate to mitigate the overload. We then demonstrate how to extend our analytical approach to the modeling of our overload control solution. Simulation based on this analytical model runs much faster than event-driven simulation, which needs to track thousands of retransmission timers for outstanding messages and may crash a simulator due to limited computation resources. Performance evaluation demonstrates that: (1) without the control algorithm applied, the overload at a downstream server may propagate to its upstream servers and cause widespread network failure; (2) in the case of short-term overload, our feedback control solution can mitigate the overload effectively without rejecting calls intentionally or reducing network utilization, thus avoiding the disadvantages of existing overload control solutions. In addition, compared with the pushback solution, our retransmission-based solution achieves a better trade-off between the speed to cancel the overload and the call rejection rate when an overload lasts a short period.

Overload control in SIP networks using no explicit feedback: A window based approach

The Session Initiation Protocol (SIP) has gained momentum and is being widely used both in the Internet and Next Generation Telecommunications networks as the core signaling protocol. SIP operation relies on SIP servers which are responsible for routing SIP messages. It has been shown that the performance of SIP servers is largely degraded during overload periods due to the built in message re-transmission mechanism of SIP. In this paper we propose a distributed and end-to-end adaptive window based overload control algorithm, which does not use explicit feedback from the downstream server. Upstream servers use call establishment delay as a measure of the amount of load on the downstream server. Therefore, the proposed algorithm imposes no additional complexity or processing on the downstream server which is overloaded, making it a very robust approach. Using simulations we show that our proposed method achieves higher throughput than a commonly used overload control algorithm and is also fair among different upstream servers under different network latencies. To the best of our knowledge, fairness under different network latencies has not been previously addressed in the context of SIP overload control. In addition, compared with approaches using explicit feedback, our scheme is less sensitive to network latency. The proposed overload control algorithm is also implemented in the OpenSIPS open source SIP proxy and shown to perform as expected under various conditions.

SIP overload control

Overload happens in Session Initiation Protocol (SIP) networks when SIP servers have insufficient resources to handle all messages they receive. Under overload, SIP networks suffer from congestion collapse due to its ineffective overload control mechanism. In this paper we propose a backpressure-based SIP overload control mechanism called Bassoon. It consists of two parts: the first part is a provably optimal load balancing algorithm that ensures full utilization of the available network resources. The second part is an end-to-end load control algorithm that intelligently throttles excessive traffic at the edge of the network. We show that, by combining optimal load balancing and end-to-end load control, Bassoon effectively controls overload in SIP networks and outperforms existing schemes in terms of goodput, fairness and responsiveness.

Nationwide SIP Telephony Network Design to Prevent Congestion Caused by Disaster

We present a session initiation protocol (SIP) network design for a voice-over-IP network to prevent congestion caused by people calling friends and family after a disaster. The design increases the capacity of SIP servers in a network by using all of the SIP servers equally. It takes advantage of the fact that equipment for voice data packets is different from equipment for signaling packets in SIP networks. Furthermore, the design achieves simple routing on the basis of telephone numbers. We evaluated the performance of our design in preventing congestion through simulation. We showed that the proposed design has roughly 20 times more capacity, which is 57 times the normal load, than the conventional design if a disaster were to occur in Niigata Prefecture struck by the Chuetsu earthquake in 2004.

Session Initiation Protocol Automatic Debugger

This paper aims to propose a session initiation protocol (SIP) automatic debugger tool. It is a software instrument that will be used to verify the compliance of voice over Internet protocol (VoIP) devices, such as soft phones and VoIP gateways to the SIP specifications, and to test the interoperability of VoIP equipment produced by different manufacturers. Different tools are available on the market to conduct a compliance and interoperability validation phase. However, they often have features limited to packet capturing and decoding, or they are simulation tools that often require a complex developing phase to define the behavior of each test. The proposed tool, instead, can be inserted into an SIP network and is capable of observing and analyzing, in an automatic way, the communication steps. It operates by executing three subsequent phases. In the first phase, the SIP messages flowing in the network are captured. Then, a second phase is in charge of grouping SIP messages into transactions and dialog. Finally, a third phase operates by comparing the message flow with a set of predefined rules. Rules have been classified in two groups. Rules belonging to the first group, called static rules, have been obtained by the direct analysis of SIP specifications. Rules belonging to the second group, called dynamic rules, have been obtained by experience with SIP compliance and interoperability testing (with the support of SIP testing experts). When verification of some rules fails, an output is reported by indicating the rule that failed and a list of possible fault causes. The tool has been validated in a laboratory network in different scenarios. Some sample test cases, which have been extracted by these scenarios and show the capability of the SIP automatic debugger tool in finding compliance and interoperability faults, are also presented in this paper.