Specification-based denial-of-service detection for SIP voice-over-IP networks

Security threats for voice-over IP (VoIP) networks are becoming a major concern as its popularity increases. New attacks are developed that target directly the underlying SIP protocol. To detect such kinds of attacks we present a specification-based detection framework to recognise deviation from its expected behaviour. We present an implementation and show with measurements that this method is capable of attack detection and mitigation for different kinds of attacks directed towards a SIP infrastructure, including denial-of-service message flooding.