Denial of service attack and prevention on SIP VoIP infrastructures using DNS flooding

Proceedings of the 1st International Conference on Principles, Systems and Applications of IP Telecommunications, IPTComm '07

Volumn , Issue , 2007, Pages 57-66

  Zhang, Ge ^a   Ehlert, Sven ^a   Magedanz, Thomas ^a   Sisalem, Dorgham ^b  

^a FRAUNHOFER FOKUS   (Germany)

^b Tekelec   (Germany)

Author keywords

Denial of service; DNS; DoS; Prevention; SIP; VoIP

Indexed keywords

ATTACK DETECTION; CACHING STRATEGY; DENIAL OF SERVICE ATTACKS; DENIAL-OF-SERVICE; DOMAIN NAMES; NON-BLOCKING; SIP SERVER;

COMPUTER CRIME; INTERNET TELEPHONY; SECURITY OF DATA; SERVERS; TRANSMISSION CONTROL PROTOCOL; VOICE/DATA COMMUNICATION SYSTEMS;

INTERNET PROTOCOLS;

EID: 44549085455     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1326304.1326314     Document Type: Conference Paper

References (31)

1. J. Mirkovic, S. Dietrich, D. Dittrich, and P. Reiher, "Internet Denial of Service: Attack an Defense Mechanisms" Prentice Hall, USA, 2004.
2. L. Gordon et al., "CSI/FBI Computer Crime and Securi Survey", Computer Security Inst., 2004.
3. F. Cao and S. Malik, "Security Analysis and Solutions for Deploying IP Telephony in the Critical Infrastructure", Workshop of the 1st International Conference on Security and Privacy for Emergng Areas in Commniation Networks, 2005.
4. D. Sisalem, J. Kuthan and S. Ehlert, "Denial of Servic Attacks Targeting a SIP VoIP Infrastructure: Attack Scenarios and Prevention Mechanisms", IEEE Network Vol20, No.5 - Special Issue on Securing VoIP, Sep. 2006.
5. D.R. Kuhn, TJ. Walsh and S. Fries, "Security Considerations for Voice over IP Systems", Recommendations of the National Institute of Standards an Technology, January 2005.
6. A. Johnston, D. Piscitello, "Understanding VoIP Securiy" Artech House.
7. D. Geneiatakis, G. Kambourakis, T. Dagiuklas, C. Lambrinoudakis and S. Gritzalis, "A Framework for Detecting Malformed Messages in SIP Networks", 14th IEEE Workshop on Local and Metropolitan Area Networks (LANMAN 200), 2005
8. Eric Y. Chen, "Detecting DoS Attacks on SIP System", 1st IEEE Workshop on VoIP Management and Security, 2006 April 2006.
9. H. Sengar, D. Wijesekera, H. Wang and S. Jajodia, "Fast Detection of Denial of Service Attacks on IP Telephone" Proceedings o IEEE IWQoS '2006, New Haven, CT, Jun 2006.
10. M. Nassar, R. State, O. Festor, "Intrusion Detection Mechanisms for VoIP Applications", 3rd Annual VoIP Security Workshop, Jun 2006, Berlin, Germany.
11. CERT, "Denial of Service Attacks using Nameserver", 2000. http://www.certorg/incident notes/IN- 2000-04.html
12. F. Guo, J. Chen, T. Chiueh, "Spoof Detection for Preventin DoS Attacks against DNS servers", 26th IEEE Internationa Conferenc on Distributed Computing Systems, 2006
13. J. Rosenberg, H. Schulzrinne, G. Camarillo, A. Johnston, R. Spark, M. Handley, E. Schooler, "RFC 3261: SIP -- Session Initiation Protocol", 2002.
14. R. Fielding , J. Gettys, J. Mogul, H. Frystyk, L. Masinter, P. Leach, T. Berners-Lee, "RFC 2616: Hypertext Transfer Protoco -- HTTP/1.", 1999.
15. G. Camarillo, M.-A. García-Martín The 3G IP Multimedia Subsystem (IMS): Merging the Internet and the Cellular Worlds", John Wiley & Sons, 2006.
16. P.V. Mockapetris, "RFC 134: Domain Name - Concept and Facilities," Nov. 1987.
17. P.V. Mockapetris, "RFC 1035: Domain Names - Implementation and Specification," Nov. 1987.
18. J. Rosenberg, H. Schulzrinne, "RFC 3063:SIP -- Locating SIP Servers", June 2002.
19. J. Peterson, H. Liu, J. Yu and B. Campbell, "RFC 3824: Using E.164 Numbers with the Session Initiation Protoco SIP)", 2004.
20. A. Gulbrandsen, P. Vixie and L. Esibov, "RFC 2782: A DNS RR for Specifying the Location of Service (DNS SRV)" Feb 2000.
21. J. Jung, E. Sit, H. Balakrishnan and R. Morris, "DNS Performance and the Effectiveness of Caching" IEEE/ACM Transactions on Networking (TON), Jan. 2002.
22. V. Pappas, Z. Xu, S. Lu, D. Massey, A. Terzis and L. Zhang "Impact of Configuration Errors on DNS Robustness", SIGCOMM'04 Workshop, Sep. 2004, Portland, Oregon USA.
23. Berkeley Internet Name Domain (BIND), Open source DNS server http://www.isc.org.
24. SIP Express Router, Open source SIP proxy http://www.iptel.org/ser.
25. SIPp, SIP traffic generator http //sipp.sourceforge.net.
26. A. Hussain, J. Heidemann and C. Papadopoulos, "A Framework for Classifying Denial of Service Attacks" Proceedings of the 2003 conference on Applications, technologies, architectures, and protocols for compute communications 2003
27. D. Sisalem, S. Ehlert et al. "General Reliability and Security Framework for VoIP Infrastructures" Technical Repor SNOCE-D2.2, Sep 2005, www.snocer.org.
28. A. Silberschatz and P.B. Galvin, Operating Systems oncepts, fourth ed. Reading Addison-Wesley, 1994.
29. C. Aggarwal, J. Wolf, and P. Yu, "Caching on the World Wide Web", IEEE Transactions on Knowledg an Data Engineering, Vol.11, No.1, Jan 1999.
30. U. Chejaral, H.-K. Chail, and H. Chol, "Performance Comparison of Different Cache-Replacement Policies for Video Distribution in CDN", 7th IEEE International Conference on High Speed Networks and Multimedia Communications, Toulouse, France, 2004
31. Tom Olzak, "DNS cache poisoning", Whitepaper, http://www.infosecwriters.com/text-resources/pdf DNS-Tolzak.pd