Detecting DoS attacks on SIP systems

As VoIP technology becomes more widely deployed due to its economical advantage over traditional PSTN services, VoIP servers and clients will become attractive targets of denial of service (DoS) attacks. This paper proposes a method to detect DoS attacks that involve flooding SIP entities with illegitimate SIP messages. We modify the original finite-state machines for SIP transactions in such a way that transaction anomalies can be detected in a stateful manner. We also propose to use four threshold parameters to confirm an attack.