Fast detection of denial-of-service attacks on IP telephony

IEEE International Workshop on Quality of Service, IWQoS

Volumn , Issue , 2006, Pages 199-208

  Sengar, Hemant ^a   Wang, Haining ^b   Wijesekera, Duminda ^a   Jajodia, Sushil ^a  

^a Krasnow Institute for Advanced Study   (United States)

^b Dept of Economics and Thomas Jefferson Program in Public Policy at the College of William and Mary   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

IP TELEPHONY; STATISTICAL DETECTION MECHANISM; TRAFFIC ANOMALIES;

INTERNET PROTOCOLS; NETWORK SECURITY; PACKET SWITCHING; PROBABILITY DISTRIBUTIONS; REAL TIME SYSTEMS; VOICE/DATA COMMUNICATION SYSTEMS;

TELECOMMUNICATION SERVICES;

EID: 34250615390     PISSN: 1548615X     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/IWQOS.2006.250469     Document Type: Conference Paper

References (30)

1. CISCO SIP Proxy Server. SIP High Availability Overview, www.cisco.com/univercd/cc/td/doc/product/software/ios123/123cgcr/vvfax_c/ callc_c/sip_c/sipha-c/hachapl.htm, 2005.
2. Ethereal. Network Protocol Analyzer, http://www.ethereal.com/, 2005.
3. iSoftlech SIP Proxy Server. Software Design Overview Template, www.isofttech.com/downloads/SIP_3261_Proxy_Stack.pdf, 2005.
4. Arbor Networks. Arbor Peakflow and Netflow. Product Overview, http:/www.arbornetworks.com/downloads/, 2006.
5. M. Basseville and I. V. Nikiforov. Detection of Abrupt Changes : Theory and Applications. Prentice Hall, 1st edition, 1993.
6. M. Carson and D. Santay. NIST Net Network Emulation Package. Nist Net Web site : http://snad.ncsl.nist.gov/itg/nistnet/, June 1998.
7. T. Darmohray and R. Oliver. Hot Spares for DoS attacks. The Magazine of USENIX and SAGE, ;login, 25(7), July 2000.
8. DEC. Digital Equipment Corporation traces. Hourly Traffic traces, http://ita.ee.lbl.gov/html/confrib/DEC-PKT.html, 2005.
9. A. Deslauriers, J. Pichitlamken, P. L'Ecuyer, and A. N. Avramidis. Markov chain models of a telephone call center with call blending. Technical report, GERAD and DIRO, University of Montreal, 2003. Preprint.
10. M. Fannes and P. Spincemaille. The mutual affinity of random measures. In eprint arXiv:math-ph/0112034, December 2001.
11. S. Gomatam, A. F. Karr, C. C. Liu, and A. P. Sanil. Data swapping: A risk-utility framework and web service implementation. In DG.O, 2003.
12. M. Handley and V. Jacobson. SDP: Session Description Protocol. RFC 2327, IETF Network Working Group, 1998.
13. V. Jacobson and M. J. Karels. Congestion avoidance and control. In Proceedings of the Sigcomm '88 Symposium in Stanford, CA, August, 1988, volume 18, 4, pages 314-329, 1988.
14. G. Jongbloed and G. Koole. Managing uncertainty in call centers using Poisson mixtures. Applied Stochastic Models in Business and Industry, 17:307-318, 2001.
15. Mazu Networks. Mazu Profiler. Product Overview, http:/www.mazunetworks. com/resources/product-sheets/, 2006.
16. NLANR, Front Range GigaPOP. NLANR network traffic traces. Daily traffic traces, http://pma.nlanr.net/Traces/, 2005.
17. Paul Russell, netfilter/iptables. Firewall, http://www.netfilter.org/, 2005.
18. D. Pollard. Asymptopia. http://www.stat.yale.edu/ pollard/ (Book in Progress), 1st edition, 2000.
19. Qovia Inc. Network Intrusion and QoS impact in VoIP. White paper, http://www.qovia.com/, August 2004.
20. B. Reynolds and D. Ghosal. Secure IP Telephony using Multi-layered Protection. In Proceedings of the Network and Distributed System Security Symposium (NDSS), February 2003.
21. J. Rosenberg, H. Schulzrinne, G. Camarillo, A. Johnston, J. Peterson, R. Sparks, M. Handley, and E. Schooler. SIP: Session Initiation Protocol. RFC 3261, IETF Network Working Group, 2002.
22. H. Sengar, D. Wijesekera, H. Wang, and S. Jajodia. VoIP Intrusion Detection Through Interacting Protocol State Machines. In IEEE Dependable Systems and Networks Conference (DSN 2006), June 2006.
23. W. Stevens. TCP/IP Illustrated Volume-1. Addison-Wesley Publishing Company, 1st edition, 1994.
24. S. J. Stolfo, W.-J. Li, S. Hershkop, K. Wang, C.-W. Hu, and O. Nimeskern. Detecting viral propagations using email behavior profiles. ACM Transactions on Internet Technology (TOIT), May 2004.
25. Telecost. Telecost : On Call Durations. Product Overview, http://www.telecost.co.uk/Products/OnCallDurations.htm, 2005.
26. K. Thompson, G. J. Miller, and R. Wilder. Wide-Area Internet Traffic Patterns and Characteristics. In IEEE Network, volume 11, November/December 1997.
27. H. Wang, D. Zhang, and K. G. Shin. Detecting syn flooding attacks. In IEEE INFOCOM, June 2002.
28. H. Wang, D. Zhang, and K. G. Shin. Syn-dog: Sniffing syn flooding sources. In IEEE ICDCS, July 2002.
29. World Agroforestry Center. Regression and Analysis of Variance. Tutorial, http://www.worldagroforestry.org/, 2005.
30. Y. Wu, S. Bagchi, S. Garg, N. Singh, and T. Tsai. SCIDIVE: A Stateful and Cross Protocol Intrusion Detection Architecture for Voice-over-IP Environments. In IEEE Dependable Systems and Networks Conference (DSN 2004), June 2004.