A novel method for detecting attacks towards the SIP protocol

In the last few years the number and impact of security attacks over the Internet, and in particular against VoIP, have been continuously increasing. To face this issue, the use of intrusion detection systems (IDSs) has emerged as a key element in network and application security. In this paper we address the problem considering a novel statistical technique for detecting attacks towards the SIP protocol. Our approach is based on the use of Markovian models (namely high order Markov chains) for modelling SIP signalling traffic. In particular our work focuses on detection of three kinds of attacks: VoIP fuzzing, flood based denial of service, and signalling manipulation. The performance results shown in the paper, justify the proposed method and highlight the improvements over commonly used statistical techniques.