An Empirical Study of Denial of Service (DoS) against VoIP

摘要

This research is motivated by consistent hacking activities against our Voice over IP (VoIP) servers where we observed millions of intrusion attempts from all over the world. From the syslog data on a server, we observed the REGISTER flooding attack. We then conducted a more thorough study by capturing every incoming and outgoing SIP packet from the tcpdump data. In addition to the REGISTER flooding attack, we also identified the INVITE flooding attack. Our major findings are (1) a REGISTER flooding rate of 200 msg/sec has the potential to deplete CPU resource and causes a Denial of Service (DoS) attack, and (2) an INVITE flooding rate with only 110 msg/sec could cause a DoS attack because of process stack overflow. We also discuss different approaches to prevent the DoS attacks against IP-PBX.