A whitelist approach to protect SIP servers from flooding attacks

As SIP-based VoIP services are expected to slowly replace the traditional PSTN services, SIP servers are becoming potential targets of various attacks, one of which is flooding. In this paper, we argue that whitelist, as a strategy to defend against flooding attacks, can be more effective on a SIP server than a Web server. Since most SIP clients tend to have persistent connections with their server, and a whitelist is relatively easy to maintain. The methodology we propose to build a whitelist is capable of keeping the most comprehensive and up-to-date information about the legitimate SIP clients without any integration with a SIP server. We also study the impact of various attacks on a SIP server, and evaluate the effectiveness of our approach under the most powerful attacks.