Detecting voIP floods using the hellinger distance

IEEE Transactions on Parallel and Distributed Systems

Volumn 19, Issue 6, 2008, Pages 794-805

  Sengar, Hemant ^a   Wang, Haining ^b   Wijesekera, Duminda ^a   Jajodia, Sushil ^a  

^a George Mason University   (United States)

^b William and Mary   (United States)

Author keywords

Communication networking and information technology; Network level security and protection

Indexed keywords

INFORMATION TECHNOLOGY; NETWORK SECURITY; PROBABILITY DISTRIBUTIONS; TELECOMMUNICATION TRAFFIC; TRANSMISSION CONTROL PROTOCOL;

FLOOD DETECTION SYSTEMS; HELLINGER DISTANCE; VOICE STREAMS;

INTERNET TELEPHONY;

EID: 44049088453     PISSN: 10459219     EISSN: None     Source Type: Journal    
DOI: 10.1109/TPDS.2007.70786     Document Type: Article

References (39)

1. "CISCO SIP Proxy Server," SIP High Availability Overview, www.cisco.com/univercd/cc/td/doc/product/ software/ios123/123cgcr/vvfax_c/callc_c/sip_c/sipha_c/hachap1.htm, 2005.
2. "iSoftTech SIP Proxy Server," Software Design Overview Template, www.isofttech.com/downloads/SIP_3261Ρoxy_Stack.pdf, 2005.
3. AltiGen Communications, AltiGen Alti-IP 600H IP Telephone, Product Overview - VoIP Phones, http://www.altigen.com/ analog-IP-telephone-sets.html, 2005.
4. Arbor Networks, Arbor Peakflow and Netflow, Product Overview, http://www.arbornetworks.com/downloads/, 2006.
5. M. Carson and D. Santay, NIST Net Network Emulation Package, Nist Net Web Site, http://snad.ncsl.nist.gov/itg/nistnet/, June 1998.
6. E. Chen, "Detecting Dos Attacks on Sip Systems," Proc. IEEE First Workshop VoIP Management and Security (VoIP MaSe '06), Apr. 2006.
7. T. Darmohray and R. Oliver, "Hot Spares for DoS Attacks," ;login: The Magazine of Usenix and SAGE, vol. 25, no. 7, July 2000.
8. DEC, "Digital Equipment Corporation Traces," Hourly Traffic Traces 2005.
9. A. Deslauriers, J. Pichitlamken, P. L'Ecuyer, and A.N. Avramidis, "Markov Chain Models of a Telephone Call Center with Call Blending," technical report, GERAD and DIRO, Univ. of Montreal, 2003.
10. T. Eyers and H. Schulzrinne, "Predicting Internet Telephony Call Setup Delay," Proc. First IP-Telephony Workshop (IPtel '00), Apr. 2000.
11. M. Fannes and P. Spincemaille, The Mutual Affinity of Random Measures eprint arXiv:mAth-ph/0112034, Dec. 2001.
12. R. Fielding, J. Gettys, J. Mogul, H. Frystyk, L. Masinter, P. Leach, and T. Berners-Lee, Hypertext Transfer Protocol - HTTP1.1, IETF RFC 2616, 1999.
13. S. Gomatam, A.F. Karr, C. Liu, and A.P. Sanil, "Data Swapping: A Risk-Utility Framework and Web Service Implementation," Proc. Nat'l Conf. Digital Government Research (DG.O), 2003.
14. M. Handley and V. Jacobson, SDP: Session Description Protocol, IETF RFC 2327, 1998.
15. A. Hoffmann, "Securing Large Scale VoIP Infrastructures," Proc. Third Ann. VoIP Security Workshop, June 2006.
16. V. Jacobson and M.J. Karels, "Congestion Avoidance and Control," Proc. ACM SIGCOMM '88, pp. 314-329, Aug. 1988.
17. A.B. Johnston, SIP Understanding the Session Initiation Protocol, second ed. Artech House, 2004.
18. G. Jongbloed and G. Koole, "Managing Uncertainty in Call Centers Using Poisson Mixtures," Applied Stochastic Models in Business and Industry, vol. 17, pp. 307-318, 2001.
19. J. Klensin, Simple Mail Transfer Protocol, IETF RFC 2821, 2001.
20. Mazu Networks, "Mazu Profiler," Product Overview, http://www.mazunetworks.com/resources/product-sheets/, 2006.
21. NLANR, NLANR Network Traffic Traces, Front Range GigaPOP, Daily traffic traces, http://pma.nlanr.net/Traces/, 2005.
22. P. Russell, Netfilter/iptables, Firewall, http://www.netfilter.org/, 2005.
23. D. Pollard, Asymptopia, first ed., book in progress, http:// www.stat.yale.edu/pollard/, 2000.
24. Qovia Inc., "Network Intrusion and QoS Impact in VoIP," white paper, http://www.qovia.com/, Aug. 2004.
25. B. Reynolds and D. Ghosal, "Secure IP Telephony Using Multi-Layered Protection," Proc. Network and Distributed System Security Symp. (NDSS '03), Feb. 2003.
26. J. Rosenberg, H. Schulzrinne, G. Camarillo, A. Johnston, J. Peterson, R. Sparks, M. Handley, and E. Schooler, SIP: Session Initiation Protocol IETF RFC 3261, 2002.
27. H. Scholz, "Attacking VoIP Networks," Proc. Third Ann. VoIP Security Workshop, June 2006.
28. H. Schulzrinne, S. Casner, R. Frederick, and V. Jacobson, RTP: A Transport Protocol for Real-Time Applications, IETF RFC 1889, 1996.
29. H. Sengar, H. Wang, D. Wijesekera, and S. Jajodia, "Fast Detection of Denial of Service Attacks on IP Telephony," Proc. 14th Int'l Workshop Quality of Service (IWQoS '06), June 2006.
30. H. Sengar, D. Wijesekera, H. Wang, and S. Jajodia, "VoIP Intrusion Detection through Interacting Protocol State Machines," Proc. Int'l Conf. Dependable Systems and Networks (DSN '06), June 2006.
31. W. Stevens, TCP/IP Illustrated Volume-1, first ed. Addison-Wesley, 1994.
32. S.J. Stolfo, W.-J. Li, S. Hershkop, K. Wang, C.-W. Hu, and O. Nimeskern, "Detecting Viral Propagations Using Email Behavior Profiles," ACM Trans. Internet Technology, May 2004.
33. Telecost, Telecost: On Call Durations, Product Overview, http:// www.telecost.co.uk/Products/OnCallDurations.htm, 2005.
34. K. Thompson, G.J. Miller, and R. Wilder, "Wide-Area Internet Traffic Patterns and Characteristics," IEEE Network, vol. 11, Nov./Dec. 1997.
35. H. Wang, D. Zhang, and K.G. Shin, "Detecting SYN Flooding Attacks," Proc. IEEE INFOCOM '02, June 2002.
36. H. Wang, D. Zhang, and K.G. Shin, "SYN-Dog: Sniffing SYN Flooding Sources," Proc. 22nd Int'l Conf. Distributed Computing Systems (ICDCS '02), July 2002.
37. "World Agroforestry Center," Regression and Analysis of Variance Tutorial, http://www.worldagroforestry.org/, 2005.
38. Y. Wu, S. Bagchi, S. Garg, N. Singh, and T. Tsai, "SCIDIVE: A Stateful and Cross Protocol Intrusion Detection Architecture for Voice-over-IP Environments," Proc. Int'l Dependable Systems and Networks Conf. (DSN '04), June 2004.
39. Zultys Technologies, "Datasheet-ZIP 4X4," Product Overview - VoIP Phones, http://www.zultystechnologies.com, 2005.