A scalable detection and prevention scheme for voice over internet protocol (VoIP) signaling attacks using handler with Bloom filter

摘要

In this paper, a two-tier model has been developed that includes a Handler and a Bloom filter (HBF). In the first-tier, the handler detects both the flooding and fake signaling attacks. The Bloom filter, in the second-tier, prevents both the attacks before reaching the victim. In the existing systems, the packet level features are used which do not perform well for detection and prevention of both the attacks. In this work, flow level features are applied in both tiers. The proposed model is implemented on the innocent Session Initiation Protocol (SIP) server in the VoIP network. The two-tier model ensures the reliability and trustworthiness between the service provider and the customer. Besides, it also provides billing information along with the exact call duration to a customer who makes a call. The experimental results show that the HBF results in a reduced detection time of 9seconds with the reduced false positive (FP) of less than 1% and the false negative (FN) of 0.002% and also preserves the voice call quality during media conversation.