A Comprehensive Survey of Voice over IP Security Research
---
paper_title: Voice over IP: Risks, Threats and Vulnerabilities

paper_content:

Voice over IP (VoIP) and Internet Multimedia Subsystem (IMS) technologies are rapidly being adopted by consumers, enterprises, governments and militaries. These technologies offer higher flexibility and more features than traditional telephony (PSTN) infrastructures, as well as the potential for lower cost through equipment consolidation and, for the consumer market, new business models. However, VoIP/IMS systems also represent a higher complexity in terms of architecture, protocols and implementation, with a corresponding increase in the potential for misuse. Here, we begin to examine the current state of affairs on VoIP/IMS security through a survey of known/disclosed security vulnerabilities in bug-tracking databases. This paper should serve as a starting point for understanding the threats and risks in a rapidly evolving set of technologies that are seeing increasing deployment and use. Our goal is to gain a better understanding of the security landscape with respect to VoIP/IMS, toward directing future research in this and other similar emerging technologies.
---
paper_title: A Look at VoIP Vulnerabilities

paper_content:

Voice over IP (VOIP) and Internet Multimedia Subsystem (IMS) technologies offer higher flexibility than traditional telephony infrastructures and the potential for lower cost through equipment consolidation and new business models. In this article, I examined the current state of affairs on VOIP/IMS security through a survey of all the 221 kown/disclosed security vulnerabilities in the Common vulnerabilities and Exposure (CVE) database and in IETF RFCs/drafts. My key finding is than the higher complexity of VOIP/IMSsystems leads to a variety of attcks vectors, many of them caused by unforeseen and unexpected components interactions. A second finding is that what people seem to worry about in VOIP (traffic interception and impresionation) bears no resemblance to the distribution of vulnerabilities actually disclosed. The article concludes with some practical suggestions for securing VOIP systems.
---
paper_title: Datagram Transport Layer Security

paper_content:

This document specifies Version 1.0 of the Datagram Transport Layer ::: Security (DTLS) protocol. The DTLS protocol provides communications ::: privacy for datagram protocols. The protocol allows client/server ::: applications to communicate in a way that is designed to prevent ::: eavesdropping, tampering, or message forgery. The DTLS protocol is ::: based on the Transport Layer Security (TLS) protocol and provides ::: equivalent security guarantees. Datagram semantics of the underlying ::: transport are preserved by the DTLS protocol. [STANDARDS-TRACK]
---
paper_title: An Introduction to the Stream Control Transmission Protocol (SCTP)

paper_content:

This document provides a high level introduction to the capabilities supported by the Stream Control Transmission Protocol (SCTP). It is intended as a guide for potential users of SCTP as a general purpose transport protocol.
---
paper_title: RTP: A Transport Protocol for Real-Time Applications

paper_content:

This memorandum describes RTP, the real-time transport protocol. RTP provides end-to-end network transport functions suitable for applications transmitting real-time data, such as audio, video or simulation data, over multicast or unicast network services. RTP does not address resource reservation and does not guarantee quality-of-service for real-time services. The data transport is augmented by a control protocol (RTCP) to allow monitoring of the data delivery in a manner scalable to large multicast networks, and to provide minimal control and identification functionality. RTP and RTCP are designed to be independent of the underlying transport and network layers. The protocol supports the use of RTP-level translators and mixers.
---
paper_title: A Look at VoIP Vulnerabilities

paper_content:

Voice over IP (VOIP) and Internet Multimedia Subsystem (IMS) technologies offer higher flexibility than traditional telephony infrastructures and the potential for lower cost through equipment consolidation and new business models. In this article, I examined the current state of affairs on VOIP/IMS security through a survey of all the 221 kown/disclosed security vulnerabilities in the Common vulnerabilities and Exposure (CVE) database and in IETF RFCs/drafts. My key finding is than the higher complexity of VOIP/IMSsystems leads to a variety of attcks vectors, many of them caused by unforeseen and unexpected components interactions. A second finding is that what people seem to worry about in VOIP (traffic interception and impresionation) bears no resemblance to the distribution of vulnerabilities actually disclosed. The article concludes with some practical suggestions for securing VOIP systems.
---
paper_title: Internet Denial-of-Service Considerations

paper_content:

This document provides an overview of possible avenues for denial-of- ::: service (DoS) attack on Internet systems. The aim is to encourage ::: protocol designers and network engineers towards designs that are more ::: robust. We discuss partial solutions that reduce the effectiveness of ::: attacks, and how some solutions might inadvertently open up ::: alternative vulnerabilities. This memo provides information for the ::: Internet community.
---
paper_title: A policy framework for personalized and role-based SPIT prevention

paper_content:

Voice over IP (VoIP) deployment is increasing at fast pace. Due to the expected decrease of cost for call initiations with VoIP and the risk of infected devices, Spam over IP Telephony (SPIT) is likely to be a serious threat for VoIP service architectures in the near future. Since SPIT is a very personal matter, users must be able to express the level of intrusiveness acceptable to them when receiving calls, i.e., the degree to which a callee is willing to be disturbed by potentially unsolicited calls. Further, companies have a need to enforce role-based and status-based SPIT protection policies in order to allow, e.g., a higher level of intrusiveness for a secretary during the day than for the CEO on his/her mobile at night. In this paper, we derive requirements for a protection system that enables personalized and role-based SPIT prevention. We examine existing solutions and show that they are insufficient to meet these requirements. Based on this comparison, we design a framework for personalized SPIT prevention. To demonstrate that our framework is capable of meeting the requirements, we give examples that show how important use cases can be addressed with this framework. Finally, we report on our prototypical implementation of the framework in a SIP PBX.
---
paper_title: Datagram Transport Layer Security

paper_content:

This document specifies Version 1.0 of the Datagram Transport Layer ::: Security (DTLS) protocol. The DTLS protocol provides communications ::: privacy for datagram protocols. The protocol allows client/server ::: applications to communicate in a way that is designed to prevent ::: eavesdropping, tampering, or message forgery. The DTLS protocol is ::: based on the Transport Layer Security (TLS) protocol and provides ::: equivalent security guarantees. Datagram semantics of the underlying ::: transport are preserved by the DTLS protocol. [STANDARDS-TRACK]
---
paper_title: Voice over IP: Risks, Threats and Vulnerabilities

paper_content:

Voice over IP (VoIP) and Internet Multimedia Subsystem (IMS) technologies are rapidly being adopted by consumers, enterprises, governments and militaries. These technologies offer higher flexibility and more features than traditional telephony (PSTN) infrastructures, as well as the potential for lower cost through equipment consolidation and, for the consumer market, new business models. However, VoIP/IMS systems also represent a higher complexity in terms of architecture, protocols and implementation, with a corresponding increase in the potential for misuse. Here, we begin to examine the current state of affairs on VoIP/IMS security through a survey of known/disclosed security vulnerabilities in bug-tracking databases. This paper should serve as a starting point for understanding the threats and risks in a rapidly evolving set of technologies that are seeing increasing deployment and use. Our goal is to gain a better understanding of the security landscape with respect to VoIP/IMS, toward directing future research in this and other similar emerging technologies.
---
paper_title: Socio-technical defense against voice spamming

paper_content:

Voice over IP (VoIP) is a key enabling technology for migration of circuit-switched PSTN (Public Switched Telephone Network) architectures to packet-based networks. One problem of the present VoIP networks is filtering spam calls referred to as SPIT (Spam over Internet Telephony). Unlike spam in e-mail systems, VoIP spam calls have to be identified in real time. Many of the techniques devised for e-mail spam detection rely upon content analysis, and in the case of VoIP, it is too late to analyze the content (voice) as the user would have already attended the call. Therefore, the real challenge is to block a spam call before the telephone rings. In addition, we believe it is imperative that spam filters integrate human behavioral aspects to gauge the legitimacy of voice calls. We know that, when it comes to receiving or rejecting a voice call, people use the social meaning of trust, reputation, friendship of the calling party and their own mood. In this article, we describe a multi-stage, adaptive spam filter based on presence (location, mood, time), trust, and reputation to detect spam in voice calls. In particular, we describe a closed-loop feedback control between different stages to decide whether an incoming call is spam. We further propose formalism for voice-specific trust and reputation analysis. We base this formal model on a human intuitive behavior for detecting spam based on the called party's direct and indirect relationships with the calling party. No VoIP corpus is available for testing the detection mechanism. Therefore, for verifying the detection accuracy, we used a laboratory setup of several soft-phones, real IP phones and a commercial-grade proxy server that receives and processes incoming calls. We experimentally validated the proposed filtering mechanisms by simulating spam calls and measured the filter's accuracy by applying the trust and reputation formalism. We observed that, while the filter blocks a second spam call from a spammer calling from the same end IP host and domain, the filter needs only a maximum of three calls---even in the case when spammer moves to a new host and domain. Finally, we present a detailed sensitivity analysis for examining the influence of parameters such as spam volume and network size on the filter's accuracy.
---
paper_title: An Introduction to the Stream Control Transmission Protocol (SCTP)

paper_content:

This document provides a high level introduction to the capabilities supported by the Stream Control Transmission Protocol (SCTP). It is intended as a guide for potential users of SCTP as a general purpose transport protocol.
---
paper_title: Analysis of Spectral Parameters of Audio Signals for the Identification of Spam Over IP Telephony

paper_content:

A method is presented which analyses the audio speech data of voice calls and calculates an “acoustic fingerprint”. The audio data of the voice calls are compared with each other based on spectral parameters and voice calls are identified which have a high degree of similarity. The method which is resistant to various modifications of the audio signal can be used to detect SPIT which is typically characterized by similar or identical voice calls being distributed to a large number of receivers. Privacy protection is assured since only a fingerprint but not the complete audio data of a call is stored, which does not allow a reconstruction of the content or identification of the speaker.
---
paper_title: Defense against SPIT using community signals

paper_content:

Internet Telephony has recently gained popularity. Voice over IP (VoIP) has emerged as an alternative to the current public switched telephone network (PSTN) system due to its cost efficiency. Spam inherently becomes a problem in VoIP networks. In this paper, we present our ongoing research in defending VoIP networks against spam by presenting a new defense mechanism using community signals.
---
paper_title: Socio-technical defense against voice spamming

paper_content:

Voice over IP (VoIP) is a key enabling technology for migration of circuit-switched PSTN (Public Switched Telephone Network) architectures to packet-based networks. One problem of the present VoIP networks is filtering spam calls referred to as SPIT (Spam over Internet Telephony). Unlike spam in e-mail systems, VoIP spam calls have to be identified in real time. Many of the techniques devised for e-mail spam detection rely upon content analysis, and in the case of VoIP, it is too late to analyze the content (voice) as the user would have already attended the call. Therefore, the real challenge is to block a spam call before the telephone rings. In addition, we believe it is imperative that spam filters integrate human behavioral aspects to gauge the legitimacy of voice calls. We know that, when it comes to receiving or rejecting a voice call, people use the social meaning of trust, reputation, friendship of the calling party and their own mood. In this article, we describe a multi-stage, adaptive spam filter based on presence (location, mood, time), trust, and reputation to detect spam in voice calls. In particular, we describe a closed-loop feedback control between different stages to decide whether an incoming call is spam. We further propose formalism for voice-specific trust and reputation analysis. We base this formal model on a human intuitive behavior for detecting spam based on the called party's direct and indirect relationships with the calling party. No VoIP corpus is available for testing the detection mechanism. Therefore, for verifying the detection accuracy, we used a laboratory setup of several soft-phones, real IP phones and a commercial-grade proxy server that receives and processes incoming calls. We experimentally validated the proposed filtering mechanisms by simulating spam calls and measured the filter's accuracy by applying the trust and reputation formalism. We observed that, while the filter blocks a second spam call from a spammer calling from the same end IP host and domain, the filter needs only a maximum of three calls---even in the case when spammer moves to a new host and domain. Finally, we present a detailed sensitivity analysis for examining the influence of parameters such as spam volume and network size on the filter's accuracy.
---
paper_title: Spam detection in voice-over-IP calls through semi-supervised clustering

paper_content:

In this paper, we present an approach for detection of spam calls over IP telephony called SPIT in VoIP systems. SPIT detection is different from spam detection in email in that the process has to be soft real-time, fewer features are available for examination due to the difficulty of mining voice traffic at runtime, and similarity in signaling traffic between legitimate and malicious callers. Our approach differs from existing work in its adaptability to new environments without the need for laborious and error-prone manual parameter configuration. We use clustering based on the call parameters, using optional user feedback for some calls, which they mark as SPIT or non-SPIT. We improve on a popular algorithm for semi-supervised learning, called MPCK-Means, to make it scalable to a large number of calls and operate at runtime. Our evaluation on captured call traces shows a fifteen fold reduction in computation time, with improvement in detection accuracy.
---
paper_title: Detection and mitigation of spam in IP telephony networks using signaling protocol analysis

paper_content:

We propose an innovative method to detect and block spam (unsolicited bulk calls) in IP telephony networks. Rapid adoption of voice over IP (VoIP) technology introduces new powerful options for spammers and telemarketers to increase their productivity and effectiveness. To date a few concepts have already been proposed in the VoIP spam prevention area. These prior solutions focus mainly on identity control and reliable authentication and follow in this regard the email spam solutions approach. Such measures imply at least strong collaboration of service providers and universal standardization. In this paper we describe a new method based on the analysis of the VoIP signaling messages which can assist service providers in detecting spam activity targeting their customers. This "locally centric" approach would enable a service provider to handle the call before the actual voice spam content reaches the recipient. The detection parameters depend solely on the local service provider's policy; no end-users participation/compliance is required
---
paper_title: Developing a Legally Compliant Reachability Management System as a Countermeasure against SPIT 1

paper_content:

This paper explains why SPIT (Spam over Internet Telephony) is harder to filter than conventional e-mail spam, lists scenarios, possible countermeasures, and presents a prototype for a legally compliant and privacy-friendly SPITfiltering reachability management system that is currently in development within the SPIT-AL project.
---
paper_title: CallRank: Combating SPIT using call duration, social networks and global reputation

paper_content:

The growing popularity of IP telephony systems has made them attractive targets for spammers. Voice call spam, also known as Spam over Internet Telephony (SPIT), is potentially a more serious problem than email spam because of the real time processing requirements of voice packets. We explore a novel mechanism that uses duration of calls between users to combat SPIT. CallRank, the scheme proposed by us, uses call duration to establish social network linkages and global reputations for callers, based on which call recipients can decide whether the caller is legitimate or not. CallRank has been implemented within a VoIP system simulation and our results show that we are able to achieve a false negative rate of 10% and a false positive rate of 3% even in the presence of a significant fraction of spammers.
---
paper_title: A Provider-Level Reputation System for Assessing the Quality of SPIT Mitigation Algorithms

paper_content:

The prevention of Spam over IP telephony (SPIT) is one of the greatest challenges for future large-scale deployments of VoIP telephony solutions. Some useful information for detecting SPIT calls is only available at the caller's VoIP provider. Recent approaches therefore suggest the signalling of such information among providers. However, there is currently no way for a receiving provider to assess the trustwortiness or the semantics of SPIT-related information received. Our approach tackles this problem by applying a provider-level reputation system, based on SPIT tags assigned to outgoing SIP messages by the caller's provider. The system provides an incentive to tag outgoing calls correctly, and it translates tags with arbitrary semantics into meaningful SPIT probabilities. We show analytically that our system significantly improves the receiving provider's assessment of SPIT tags.
---
paper_title: Incorporating Active Fingerprinting into SPIT Prevention Systems

paper_content:

Voice over IP (VoIP) usage is growing at an astronomical rate. While the economic benefits of deployment are clear, concerns of potential abuse of the technology may hinder its deployment. Emerging security threats such as Spam over Internet Telephony (SPIT) are not far from reality and techniques to detect and prevent SPIT are ongoing research areas. In this paper, we design and implement a firewall to detect SPIT for VoIP devices that use the Session Initiation Protocol (SIP) which is gaining momentum as the de facto signaling protocol. For SPIT detection, we use fingerprinting techniques that run protocol analysis on the remote software agent to identify VoIP devices. We build and evaluate a prototype SPIT prevention firewall that leverages fingerprint information to identify call invitations from suspicious user agents. We demonstrate that fingerprinting incurs low overhead and is efficient enough to be incorporated into SPIT prevention systems.
---
paper_title: Exploring Anti-Spam Models in Large Scale VoIP Systems

paper_content:

Although the problem of spam detection in email is well understood and has been extensively researched, a significant portion of emails today are spam. A most widely used method to detect spam involves content filtering, where the spam detector scans the received email for keywords. However, the same approach cannot be applied to detect Voice over IP (VoIP) spam, since a call has to be categorized as a legitimate or a spam (each to a degree with a certain reliability) before the connection is established. Also, spammers over IP can potentially generate orders of magnitude more spam volume, at far less cost, and with greater anonymity than telemarketers using the Public Switch Telephone Network (PSTN). The spam problem in VoIP is further compounded by the absence of a do-not-call-list, which has been the main reason for the reduction of spam calls in PSTN. Thus, the spam issue for VoIP is as important as those pertaining to quality-of-service (QoS) of the voice traffic itself. To this end, we propose two different anti-spam frameworks for large scale VoIP systems. The first one is a centralized SIP-based spam detection framework that relies on SIP messages during the call establishment phase to identify spam calls, and the second one is a distributed referral social network model, where a user is assigned a reputation score by its neighbors. Based on the reputation, a callee can decide either to accept or decline a call. Our simulation results indicate that the referral model can provide better anti-spam capabilities by isolating a spammer faster than the SIP based approach, and can also correctly identify spam calls over 98% of time.
---
paper_title: Have I Met You Before? Using Cross-Media Relations to Reduce SPIT

paper_content:

Most legitimate calls are from persons or organizations with strong social ties such as friends. Some legitimate calls, however, are from those with weak social ties such as a restaurant the callee booked a table on-line. Since a callee's contact list usually contains only the addresses of persons or organizations with strong social ties, filtering out unsolicited calls using the contact list is prone to false positives. To reduce these false positives, we first analyzed call logs and identified that legitimate calls are initiated from persons or organizations with weak social ties through transactions over the web or email exchanges. This paper proposes two approaches to label incoming calls by using cross-media relations to prior contact. One approach is that a potential caller offers the callee his contact addresses which might be used in future calls. Another is that a callee provides a potential caller with weakly-secret information. In order to be identified as someone the callee contacted before through other means, the caller can convey the information in future calls. The latter approach enables a callee to label incoming calls even without caller identifiers. Reducing false positives during filtering using our proposed approaches will contribute to the reduction in SPIT (SPam over Internet Telephony).
---
paper_title: Detecting spam in VoIP networks

paper_content:

Voice over IP (VoIP) is a key enabling technology for the migration of circuit-switched PSTN architectures to packet-based networks. The problem of spam in VoIP networks has to be solved in real time compared to e-mail systems. Many of the techniques devised for e-mail spam detection rely upon content analysis and in the case of VoIP it is too late to analyze the media after picking up the receiver. So we need to stop the spam calls before the telephone rings. From our observation, when it comes to receiving or rejecting a voice call people use social meaning of trust and reputation of the calling party. In this paper, we describe a multi-stage spam filter based on trust, and reputation for detecting the spam. In particular we used closed loop feedback between different stages in deciding if the incoming call is a spam or not. For verifying the concepts, we used a laboratory setup of several thousand soft-phones and a commercial grade proxy server. We verified our filtering mechanisms by simulating the spam calls and measured the accuracy of the filter. Results show that multistage feedback loop fares better than any single stage. Also, the larger the network size, the harder to detect a spam call. Further work includes understanding the behavior of different controlling parameters in trust and reputation calculations and deriving meaningful relationships between them.
---
paper_title: SPIT Detection and Prevention Method Based on Signal Analysis

paper_content:

In order to resolve the SPIT (spam over Internet telephony) risk in the ALL-IP convergence network, a multilayered detection and prevention method is proposed in this paper. This method firstly analyzes the unique characteristics of SPIT as well as the features of various SPIT attacks to enhance the pertinence of detection and prevention. Afterwards, the detection and prevention are divided into several layers, signal monitoring algorithm monitors the SPIT-related atom information, statistic and analysis algorithm analyzes the atom information to gain the more meaningful alert, correlation algorithm associates the alert to identify the behavior trace and reconstruct the attack scenario. Experiment and analysis results show that the efficiency and performance of the method satisfies the requirement of SPIT detection and prevention.
---
paper_title: SIP Spam Detection

paper_content:

The SIP protocol has been showing for the last few years a strong acceptance by the market. Through a large row of services, in particular VoIP calls and Instant Messaging (IM), SIP has become ubiquitous in the public communications as well as the corporated ones. As a new emerging standard, SIP will certainly be the target of Spam attacks which refer to unsolicited VoIP calls and IM messages. Before SIP spam becomes a real threat for the SIP users communities, its detection has to be so far a necessary component of our online security and privacy protection. In this paper, we investigate two complete solutions for detecting SIP spam. The first solution is based on the reputation concept and has origins in social networks. However, the second one reflects the payment at risk idea. For this technique, we propose a lightweight architecture that requires only slight changes in the existing infrastructures.
---
paper_title: An Adaptive Policy-Based Approach to SPIT Management

paper_content:

Voice over IP (VoIP) is a key enabling technology, which provides new ways of communication. VoIP technologies take advantage of existing data networks to provide inexpensive voice communications world-wide as a promising alternative to the traditional telephone service. At the same time, VoIP provides the means for transmitting bulk unsolicited calls, namely SPam over Internet Telephony (SPIT). SPIT is, up to a given extend, similar to email spam. However, it is expected to be more frustrating because of the real-time processing requirements of voice calls. In this paper we set the foundations of an adaptive approach that handles SPIT through a policy-based management approach (aSPM). aSPM incorporates a set of rules for SPIT attacks detections, together with appropriate actions and controls that should be enforced so as to counter these attacks. Furthermore, the policy is formally described through an XML schema, which refers to both, the attack detection rules, and the corresponding defense actions.
---
paper_title: A policy framework for personalized and role-based SPIT prevention

paper_content:

Voice over IP (VoIP) deployment is increasing at fast pace. Due to the expected decrease of cost for call initiations with VoIP and the risk of infected devices, Spam over IP Telephony (SPIT) is likely to be a serious threat for VoIP service architectures in the near future. Since SPIT is a very personal matter, users must be able to express the level of intrusiveness acceptable to them when receiving calls, i.e., the degree to which a callee is willing to be disturbed by potentially unsolicited calls. Further, companies have a need to enforce role-based and status-based SPIT protection policies in order to allow, e.g., a higher level of intrusiveness for a secretary during the day than for the CEO on his/her mobile at night. In this paper, we derive requirements for a protection system that enables personalized and role-based SPIT prevention. We examine existing solutions and show that they are insufficient to meet these requirements. Based on this comparison, we design a framework for personalized SPIT prevention. To demonstrate that our framework is capable of meeting the requirements, we give examples that show how important use cases can be addressed with this framework. Finally, we report on our prototypical implementation of the framework in a SIP PBX.
---
paper_title: SPam over Internet Telephony (SPIT) Prevention Framework.

paper_content:

SPam over Internet Telephony (SPIT) is expected to become a threat inhibiting the delivery of voice services over the Internet in the near future both because of its technical and economical characteristics. Experiences with email SPAM and its analogies with SPIT suggest that SPIT will be difficult to detect with a single detection method. Moreover, personalized management of detection strategies will be needed to increase effectiveness and to adapt the methods to special environments. This paper presents a modular framework for SPIT prevention designed to be easily manageable and extensible. Additionally, the framework makes use of a two-stage architecture in order to exploit the knowledge coming both from the signaling and from the media flows while still allowing real-time delivery of the media content to the user. Following the experience gained with our prototype implementation we also present the most important design issues we encountered and suggest solutions to these issues. I. INTRODUCTION Everybody knows unsolicited bulk messages or SPAM emails which have become a serious problem not only for companies but also for private users. Many users already receive more SPAM than normal messages and some estimates put the percentage of SPAM at up to 80% of all email traffic. With the increasing deployment of Voice over IP there are concerns that it will also become a target of unsolicited advertisement which for the case of VoIP has been named SPIT (SPAM over Internet Telephony). SPAM already exists in the Public Switched Telephone Network (PSTN) but because of the relatively high cost for the caller the problem is limited. VoIP on the other hand is orders of magnitude cheaper (1) and therefore a much more attractive target. Among all the Voice over IP protocols available today we look at SIP (Session Initiation Protocol, (2)) in this paper because SIP solutions dominate today's enterprise market and will soon dominate the telecom business. The most obvious form of SPIT are marketing calls placed by a computer. Typically a list of SIP addresses is called one by one and every time a call is answered some marketing content is replayed. Creating a software application which can place such calls is a trivial exercise and any commodity hardware can be used to run it. The only additional requirement is an internet connection which is able to handle a certain number of simultaneous VoIP calls. Current standardization activities (1) suggest that strongly authenticated identities (3) together with white lists (to allow known users to call) and a consent framework (4) (to solve the introduction problem) are the solution to SPIT calls. But even if these methods provide a good starting point, their effectiveness cannot be fully exploited because strongly authenticated identities cannot be enforced universally. If a callee receives a call without an authenticated identity he does not know whether the caller did not support them or whether it was intentionally not authenticated. Furthermore, there is no standardized technique to establish networks of trust in order to support a consent framework. Some research effort in this direction has also been pre- sented in (5), where a reputation-based SIP social networks approach is discussed. However, this approach is still in an early phase and requires more detailed investigation.
---
paper_title: Cure for Spam Over Internet Telephony

paper_content:

Unsolicited bulk email or spam is a menace to the usability of Internet email. The possibility of cheap Voice over IP (VoIP) services have introduced the threat of Spam over Internet Telephony (SPIT). A previously unexperimented solution for tackling the spam machinery is to increase its cost via Human Interactive Proofs (HIP). These proofs are basically applicable to all kind of spam, including email, but we concentrate on the Session Initiation Protocol (SIP) in this paper. Our approach allows the use of varying kinds of HIPs to prevent automated call connection attempts. The HIPs are used as an enrollment feature for configuring the call-recipient's call pass or block lists. By giving a proof of humanity, the caller is automatically put e.g. to the call-recipient's graylist for further processing by the user. The approach can be also used to mitigate unsolicited call connection attempts made by humans. We also present our SIP signaling based solution to address the SPIT threat.
---
paper_title: Hidden VoIP calling records from networking intermediaries

paper_content:

While confidentiality of telephone conversation contents has recently received considerable attention in Internet telephony (VoIP), the protection of the caller--callee relation is largely unexplored. From the privacy research community we learn that this relation can be protected by Chaum's mixes. In early proposals of mix networks, however, it was reasonable to assume that high latency is acceptable. While the general idea has been deployed for low latency networks as well, important security measures had to be dropped for achieving performance. The result is protection against a considerably weaker adversary model in exchange for usability. In this paper, we show that it is unjustified to conclude that low latency network applications imply weak protection. On the contrary, we argue that current Internet telephony protocols provide a range of promising preconditions for adopting anonymity services with security properties similar to those of high latency anonymity networks. We expect that implementing anonymity services becomes a major challenge as customer privacy becomes one of the most important secondary goals in any (commercial) Internet application.
---
paper_title: Security and Usability Aspects of Man-in-the-Middle Attacks on ZRTP

paper_content:

ZRTP is a protocol designed to set up a shared secret between two com- munication parties which is subsequently used to secure the media stream (i.e. the audio data) of a VoIP connection. It uses Diffie-Hellman (DH) key exchange to agree upon a session key, which is inherently vulnerable to active Man-in-the-Middle (MitM) attacks. Therefore ZRTP introduces some proven methods to detect such attacks. The most important measure is a so called Short Authentication String (SAS). This is a set of characters that is derived essentially from the public values of the Diffie-Hellman key exchange and displayed to the end users for reading out and comparing over the phone. If the SAS on the caller's and the callee's side match, there is a high probability that no MitM attack is going on. Furthermore, ZRTP offers a form of key continuity by caching key material from previous sessions for use in the next call. In order to prevent that a MitM can manipulate the Diffie-Hellman key exchange in such a way that both partners get the same SAS although different shared keys were negotiated, ZRTP uses hash commitment for the public DH value. Despite these measures a Relay Attack (also known as Mafia Fraud Attack or Chess Grandmaster Attack) is still possible. We present a practical implementation of such an attack and discuss its characteristics and limitations, and show that the attack works only in certain scenarios.
---
paper_title: Cryptanalysis of a data security protection scheme for VoIP

paper_content:

Recently, a VoIP (voice over Internet protocol) technique with a new hierarchical data security protection (HDSP) scheme was proposed by using a secret chaotic bit sequence. This paper points out some insecure properties of the HDSP scheme, and then uses them to develop known/chosen-plaintext attacks. The following main findings are: 1) given n known plaintexts, about (100 50n) percent of secret chaotic bits can be uniquely determined; 2) given only one specially-chosen plaintext, all secret chaotic bits can be uniquely derived; 3) the secret key can be derived with practically small computational complexity when only one plaintext is known (or chosen). These facts reveal that HDSP is very weak against known/chosen-plaintext attacks. Experiments are given to show the feasibility of the proposed attacks. Furthermore, it is also found that the security of HDSP against the brute-force attack is not practically strong. Finally, some countermeasures are discussed for enhancing the security of HDSP, and several basic principles are suggested for the design of a secure encryption scheme.
---
paper_title: Unregister Attacks in SIP

paper_content:

In this paper we present the unregister attack, a new kind of a denial of service attack on SIP servers. In this attack, the attacker sends a spoofed "unregister" message to a SIP server and cancels the registration of the victim at that server. This prevents the victim user from receiving any calls. We have tested common implementations of SIP servers and show that the unregister attack is easily performed on SIP servers which do not use authentication. Even on SIP servers with authentication, an attacker able to sniff the traffic between the client and server can still successfully attack common servers. We show that the root causes behind this vulnerability are either buggy implementations, or the SIP specification RFC which does not require sufficient security from the implementations. We present a solution, the SIP one-way hash function algorithm (SOFIA), motivated by the onetime password mechanism [6]. SOFIA prevents the unregister attack in all situations. The algorithm is easy to deploy since it requires only a minor modification, namely adding one header field into the SIP messages. Furthermore, the algorithm is fully backwards compatible and requires no additional configuration from the user or the server.
---
paper_title: A comparative study of anomaly detection algorithms for detection of SIP flooding in IMS

paper_content:

The IP multimedia subsystem (IMS) framework uses session initiation protocol (SIP) for signaling and control of sessions. In this paper, we first demonstrate that SIP flooding attacks on IMS can result in denial of service to the legitimate users. Afterwards, we report our comparative study of three well-known anomaly detection algorithms, adaptive threshold, cumulative sum, and Hellinger distance for detection of flood attacks in IMS. We evaluate the accuracy of the algorithms using a comprehensive traffic dataset that consists of varying benign and malicious traffic patterns.
---
paper_title: Preserving Caller Anonymity in Voice-over-IP Networks

paper_content:

Applications such as VoIP need to provide anonymity to clients while maintaining low latency to satisfy quality of service (QoS) requirements. Existing solutions for providing anonymity such as mix networks are not well suited to applications like VoIP, SSH, and gaming which require low communication latency. This paper investigates the problem of on-demand construction of QoS sensitive routes on anonymizing networks using the VoIP application. We first describe triangulation based timing analysis attacks on shortest path route set up protocols. We show that even when a small fraction (~1%) of the network is malicious, the adversary can infer the source (caller) with reasonably high probability. Second, we describe random walk based route set up protocols that significantly improve anonymity while satisfying latency- based QoS guarantees. We describe a prototype implementation of our proposal and show that our protocols can significantly reduce the probability of inferring the caller. We present a detailed experimental evaluation to demonstrate our attacks and quantify the performance and scalability of our guards.
---
paper_title: Keyboards and covert channels

paper_content:

This paper introduces JitterBugs, a class of inline interception mechanisms that covertly transmit data by perturbing the timing of input events likely to affect externally observable network traffic. JitterBugs positioned at input devices deep within the trusted environment (e.g., hidden in cables or connectors) can leak sensitive data without compromising the host or its software. In particular, we show a practical Keyboard JitterBug that solves the data exfiltration problem for keystroke loggers by leaking captured passwords through small variations in the precise times at which keyboard events are delivered to the host. Whenever an interactive communication application (such as SSH, Telnet, instant messaging, etc) is running, a receiver monitoring the host's network traffic can recover the leaked data, even when the session or link is encrypted. Our experiments suggest that simple Keyboard JitterBugs can be a practical technique for capturing and exfiltrating typed secrets under conventional OSes and interactive network applications, even when the receiver is many hops away on the Internet.
---
paper_title: RTP-miner: a real-time security framework for RTP fuzzing attacks

paper_content:

Real-time Transport Protocol (RTP) is a widely adopted standard for transmission of multimedia traffic in Internet telephony (commonly known as VoIP). Therefore, it is a hot potential target for imposters who can launch different types of Denial of Service (DoS) attacks to disrupt communication; resulting in not only substantive revenue loss to VoIP operators but also undermining the reliability of VoIP infrastructure. The major contribution of this paper is an online framework -- RTP-Miner -- that detects RTP fuzzing attacks in realtime; as a result, it is not possible to deny access to legitimate users. RTP-Miner can detect both header and payload fuzzing attacks. Fuzzing in the header of RTP packets is detected by combining well known distance measures with a decision tree based classifier. In comparison, payload fuzzing is detected through a novel Markov state space model at the receiver. We evaluate RTP-Miner on a realworld RTP traffic dataset. The results show that RTP-Miner detects fuzzing in RTP header with more than 98% accuracy and less than 0.1% false alarm rate even when only 3% fuzzing is introduced. For the same fuzzing rate, it detects payload fuzzing -- a significantly more challenging problem -- with more than 80% accuracy and less than 2% false alarm rate. RTP-Miner has low memory and processing overheads that makes it well suited for deployment in real world VoIP infrastructure.
---
paper_title: Present and future challenges concerning DoS-attacks against PSAPs in VoIP networks

paper_content:

Nowadays, voice over IP (VoIP) telephony networks are connected to classic public switched telephony networks (PSTNs). Emergency calls from VoIP peers to PSTN public service answering points (PSAPs) are possible. Through the connection of IP networks and PSTNs the PSAP may be a victim of new, more powerful denial of service (DoS) attacks. This paper describes the present and future architecture of a PSAP. Based on measurements at a PSAP the challenge of attack detection at the PSAP is revealed. Furthermore, first solutions are pointed out and evaluated.
---
paper_title: Tracking anonymous peer-to-peer VoIP calls on the internet

paper_content:

Peer-to-peer VoIP calls are becoming increasingly popular due to their advantages in cost and convenience. When these calls are encrypted from end to end and anonymized by low latency anonymizing network, they are considered by many people to be both secure and anonymous.In this paper, we present a watermark technique that could be used for effectively identifying and correlating encrypted, peer-to-peer VoIP calls even if they are anonymized by low latency anonymizing networks. This result is in contrast to many people's perception. The key idea is to embed a unique watermark into the encrypted VoIP flow by slightly adjusting the timing of selected packets. Our analysis shows that it only takes several milliseconds time adjustment to make normal VoIP flows highly unique and the embedded watermark could be preserved across the low latency anonymizing network if appropriate redundancy is applied. Our analytical results are backed up by the real-time experiments performed on leading peer-to-peer VoIP client and on a commercially deployed anonymizing network. Our results demonstrate that (1) tracking anonymous peer-to-peer VoIP calls on the Internet is feasible and (2) low latency anonymizing networks are susceptible to timing attacks.
---
paper_title: Providing true end-to-end security in converged voice over IP infrastructures

paper_content:

Voice over Internet Protocol (VoIP) is the future for voice communication and, by using a unique IP infrastructure as the common transport platform, it brings invaluable benefits such as deployment cost reduction, ease of management, ubiquitous coverage and convergence of data and voice together. On the other side, VoIP introduces new security vulnerabilities, since it comes with completely different operational and security settings than the old telephone network: the physical location of clients is not fixed and great flexibility is required to provide enhanced mobile services. Furthermore, the integration with wireless LANs, with their inherent security weaknesses, introduces the need of new security features: the payloads of voice packets should be protected during conversations and no-replay as well as user authentication must be ensured on and end-to-end basis. The above concerns are actually the major barrier that may prevent the wide deployment of VoIP technologies, and coping with them is a truly challenging task. Consequently, we developed a novel hybrid framework for enhanced end-to-end security in the new generation SIP-empowered VoIP environments, based on the introduction of proven technologies such as digital signatures and efficient streamline encryption to enforce calling party identification, privacy, no-replay and non-repudiation throughout the whole IP Telephony system. All the security mechanisms used have been carefully chosen so that no systematic method is known to break the framework in realistic times and the overall voice quality will not be affected.
---
paper_title: New voice over Internet protocol technique with hierarchical data security protection

paper_content:

The authors propose a voice over Internet protocol (VoIP) technique with a new hierarchical data security protection (HDSP) scheme. The proposed HDSP scheme can maintain the voice quality degraded from packet loss and preserve high data security. It performs both the data inter-leaving on the inter-frame of voice for achieving better error recovery of voices suffering from continuous packet loss, and the data encryption on the intra-frame of voice for achieving high data security, which are controlled by a random bit-string sequence generated from a chaotic system. To demonstrate the performance of the proposed HDSP scheme, we have successfully verified and analysed the proposed approach through software simulation and statistical measures on several test voices.
---
paper_title: Monitoring SIP Traffic Using Support Vector Machines

paper_content:

We propose a novel online monitoring approach to distinguish between attacks and normal activity in SIP-based Voice over IP environments. We demonstrate the efficiency of the approach even when only limited data sets are used in learning phase. The solution builds on the monitoring of a set of 38 features in VoIP flows and uses Support Vector Machines for classification. We validate our proposal through large offline experiments performed over a mix of real world traces from a large VoIP provider and attacks locally generated on our own testbed. Results show high accuracy of detecting SPIT and flooding attacks and promising performance for an online deployment are measured.
---
paper_title: A Cost-Effective Mechanism for Protecting SIP Based Internet Telephony Services Against Signaling Attacks

paper_content:

Internet Telephony services offer several new business opportunities to telecommunication providers. However, they also introduce several security flaws that can be exploited by various attacks, thus raising the need for the employment of suitable security measures during the provision of the service. Signaling attacks, a type of Denial of Service attacks, are an indicative example. In this paper we present a cost-effective mechanism, namely the Integrity-Auth mechanism, for protecting SIP-based telephony services from signaling attacks. The focus is on the evaluation of the mechanism in terms of the processing overheads that it introduces in various different scenarios.
---
paper_title: Detecting VoIP Floods Using the Hellinger Distance

paper_content:

Voice over IP (VoIP), also known as Internet telephony, is gaining market share rapidly and now competes favorably as one of the visible applications of the Internet. Nevertheless, being an application running over the TCP/IP suite, it is susceptible to flooding attacks. If flooded, as a time-sensitive service, VoIP may show noticeable service degradation and even encounter sudden service disruptions. Because multiple protocols are involved in a VoIP service and most of them are susceptible to flooding, an effective solution must be able to detect and overcome hybrid floods. As a solution, we offer the VoIP flooding detection system (vFDS)-an online statistical anomaly detection framework that generates alerts based on abnormal variations in a selected hybrid collection of traffic flows. It does so by viewing collections of related packet streams as evolving probability distributions and measuring abnormal variations in their relationships based on the Hellinger distance-a measure of variability between two probability distributions. Experimental results show that vFDS is fast and accurate in detecting flooding attacks, without noticeably increasing call setup times or introducing jitter into the voice streams.
---
paper_title: Detection of SIP De-Registration and Call-Disruption Attacks Using a Retransmission Mechanism and a Countermeasure Scheme

paper_content:

SIP is an application-level signaling protocol that manages a mutual multimedia communication session. Presently, SIP is widely used with Internet messaging, games and with VoIP (voice over IP) due to advantages such as its simplicity, flexibility and variety of protocols. However, SIP is associated with many types of security issues and requires a countermeasure device against call-disturbance attacks that can cause a great amount of inconvenience to users. Therefore, this study analyses SIP De- registration and call-disruption attacks and proposes a means of detecting these attacks. Attack detection is accomplished through a comparison of the messages last sent by the user and those that are considered to be an attack based on a Retransmission mechanism. When a message is detected as an attack, the user is informed and a re-authentication process is performed.
---
paper_title: A lightweight scheme for securely and reliably locating SIP users

paper_content:

Voice over Internet protocol (VOIP) is a fast growing technology believed to be the future replacement for traditional public switched telephone network (PSTN) networks. VOIP offers many benefits over PSTW, but there are still lots of issues when it comes to service reliability and security. One of the problems faced is how to locate communicating parties on the Internet in a secure and reliable manner. The security mechanisms included in RFC 3261 session initiation protocol (SIP) are either weak or expensive to deploy. In this paper, we propose a light weight scheme that can protect the integrity of SIP contact addresses. This scheme also achieves high availability of SIP services through replication. End user public key distributed in this scheme can also be used for end-to-end user authentication and media session key exchange.
---
paper_title: Detecting SPIT Calls by Checking Human Communication Patterns

paper_content:

SPam over Internet Telephony (SPIT) is expected to become a very serious issue in the next years. The threat is going to spin out from the well known email spam problem by bot nets being re-programmed to initiate not just spam emails but also Voice over IP (VoIP) calls. Preventing SPIT is a new problem, because many well-established methods for blocking email spam cannot be applied. Currently, several SPIT prevention methods are being proposed but SPIT prevention research is still at a very early stage. In this paper, we propose an innovative way to detect SPIT calls by comparing applying hidden Turing tests that compare them with typical human communication patterns. For passing these tests, significant resource consumptions at the SPIT generating bot nets would be required which contradicts the spammer's objective of placing as many SPIT calls as possible, The proposed method has several advantages compared to other methods that also interact with the caller. We validated its feasibility with a prototype implementation that we integrated into our modular VoIP security system called VoIP SEAL.
---
paper_title: SDRS: A Voice-over-IP Spam Detection and Reaction System

paper_content:

An expected surge in spam over Internet telephony (SPIT) requires a solution that incorporates multiple detection methods and reaction mechanisms, enabling greater flexibility and customization. Our solution framework combines well-known detection schemes, such as blacklists and white lists, with methods based on statistical traffic analysis, such as the number and duration of calls a user conducts.
---
paper_title: QoS control using an end-point CPU capability detector in a secure VoIP system

paper_content:

Security is a serious bottleneck for the future of VoIP. Because of the time-critical nature of VoIP most of the same security measures currently implemented in today's data networks could not be used in VoIP networks. Two main factors affect voice traffic over secure IP channels. The first is the time required to encrypt payload and headers and the construction of the new ones. The second is the increased packet size because of the headers added to the original IP packet. Techniques that could be adopted to overcome these two problems in addition to the compression QoS issues associated with audio codecs put more strain on end-point CPU's. In this paper we propose a new QoS control scheme that uses a simple protocol to detect the end-point CPU capabilities, and according to this information, we choose dynamically the most suitable techniques for the transmission of voice over a secure IP channel to provide a superior QoS control performance, in terms of perceived speech quality.
---
paper_title: Closed-Circuit Unobservable Voice over IP

paper_content:

Among all the security issues in Voice over IP (VoIP) communications, one of the most difficult to achieve is traffic analysis resistance. Indeed, classical approaches provide a reasonable degree of security but induce large round-trip times that are incompatible with VoIP. In this paper, we describe some of the privacy and security issues derived from traffic analysis in VoIP. We also give an overview of how to provide low-latency VoIP communication with strong resistance to traffic analysis. Finally, we present a server which can provide such resistance to hundreds of users even if the server is compromised.
---
paper_title: Detecting DoS attacks on SIP systems

paper_content:

As VoIP technology becomes more widely deployed due to its economical advantage over traditional PSTN services, VoIP servers and clients will become attractive targets of denial of service (DoS) attacks. This paper proposes a method to detect DoS attacks that involve flooding SIP entities with illegitimate SIP messages. We modify the original finite-state machines for SIP transactions in such a way that transaction anomalies can be detected in a stateful manner. We also propose to use four threshold parameters to confirm an attack.
---
paper_title: Prevention of Spam over IP Telephony (SPIT)

paper_content:

Spam over IP Telephony (SPIT) is expected to become a serious problem in the near future. It has the potential to become an even bigger problem than email spam, because the callee will be disturbed by each received SPIT call. This paper describes a new SPIT prevention method that is effective and acceptable for the call participants because it does not affect the callee at all and limits the interaction with the caller to an acceptable minimum. As foundation for building general SPIT prevention systems with this and other innovative methods, this paper proposes a reference architecture for SPIT prevention systems.
---
paper_title: VoIP defender: highly scalable SIP-based security architecture

paper_content:

VoIP services are becoming increasingly a big competition to existing telephony services (POTS / ISDN). The increasing number of customers using VoIP makes VoIP services a valuable target for attackers that want to bring down the service, take it over or simply abuse it to distribute their own content, like SPAM. Hence, the need arises to protect VoIP services from all kinds of attacks that target network bandwidth, server capacity or server architectural constrains. In this article we present VoIP Defender, a generic security architecture, called VoIP-Defender, to monitor, detect, analyze and counter attacks relevant for a SIP-based VoIP infrastructure. The VoIP-Defender is highly scalable and can be easily extended with new detection algorithms. Analysis and traffic control can be performed from the SIP layer down to the transport-, network- and MAC layer. VoIP Defender is designed to work fully transparent to clients and SIP servers, and can analyze and filter traffic in real time, which we demonstrate with measurements with our implementation.
---
paper_title: Fast Detection of Denial-of-Service Attacks on IP Telephony

paper_content:

Recently Voice over IP (VoIP) is experiencing a phenomenal growth. Being a real-time service, VoIP is more susceptible to Denial-of-Service (DoS) attacks than regular Internet services. Moreover, VoIP uses multiple protocols for call control and data delivery, making it vulnerable to various DoS attacks at different protocol layers. An attacker can easily disrupt VoIP services by flooding TCP SYN packets, UDP-based RTP packets, or SIP-based INVITE messages, which pose a critical threat to IP telephony. In this paper, we present an online statistical detection mechanism, called vFDS, to detect DoS attacks in the context of VoIP. The core of vFDS is based on Hellinger distance method, which computes the variability between two probability measures. Using Hellinger distance, we characterize normal protocol behaviors and then detect the traffic anomalies caused by flooding attacks. Our experimental results show that vFDS achieves fast and accurate detection of DoS attacks.
---
paper_title: Protecting SIP Proxy Servers from Ringing-Based Denial-of-Service Attacks

paper_content:

As Internet telephony systems continue to replace existing Public Switched Telephone Network systems, proxy servers running the Session Initiation Protocol (SIP) will continue to grow in importance for Voice-over-IP deployments that use SIP for call signaling. Since the protection of the global telecommunications infrastructure is critical to people's everyday lives, ensuring the availability of SIP proxy servers under attack should be a high priority. This paper first describes a disruptive denial-of-service attack that exploits the semantics of the SIP protocol to exhaust resources at a stateful SIP proxy server. Unlike previous approaches that focus on flooding-based denial-of-service attacks, we consider attacks that do not result in high incoming call traffic rates at the SIP proxy server. After describing this semantic-based attack, we then propose a new algorithm to reduce the effects of such an attack. Our algorithm has been implemented in a SIP proxy server and evaluated extensively through experiments on a local testbed.
---
paper_title: Secure IP Telephony using Multi-layered Protection

paper_content:

This paper presents the design and analysis of a multilayer protection scheme against denial-of-service (DoS) attacks in IP telephony enabled enterprise networks. While there are many types of DoS attacks, we focus on flood-based attacks using application layer and transport layer signaling messages in IP telephony. We design sensors to detect and control these types attacks and consider different location of these sensors in the enterprise network. The algorithm for detecting these attacks is based on the well established non-parametric cumulative sum method. The response to the attack uses standard protocol features of IP telephony to control the number of incoming application and transport layer setup requests. We consider different recovery algorithms and compare their performance using our emulation toolkit. Our results show that the detection algorithm can quickly detect both transport and application layer attacks and is robust against various types of attacks. We also show that with proper choice of sensor parameters, the detection algorithm is effective over a wide range of call volumes.
---
paper_title: On the feasibility of launching the man-in-the-middle attacks on VoIP from remote attackers

paper_content:

The man-in-the-middle (MITM) attack has been shown to be one of the most serious threats to the security and trust of existing VoIP protocols and systems. For example, the MITM who is in the VoIP signaling and/or media path can easily wiretap, divert and even hijack selected VoIP calls by tempering with the VoIP signaling and/or media traffic. Since all previously identified MITM attacks on VoIP require the adversary initially in the VoIP signaling and/or media path, there is a common belief that it is infeasible for a remote attacker, who is not initially in the VoIP path, to launch any MITM attack on VoIP. This makes people think that securing all the nodes along the normal path of VoIP traffic is sufficient to prevent MITM attacks on VoIP. In this paper, we demonstrate that a remote attacker who is not initially in the path of VoIP traffic can indeed launch all kinds of MITM attacks on VoIP by exploiting DNS and VoIP implementation vulnerabilities. Our case study of Vonage VoIP, the No. 1 residential VoIP service in the U.S. market, shows that a remote attacker from anywhere on the Internet can stealthily become a remote MITM through DNS spoofing attack on a Vonage phone, as long as the remote attacker knows the phone number and the IP address of the Vonage phone. We further show that the remote attacker can effectively wiretap and hijack targeted Vonage VoIP calls after becoming the remote MITM. Our results demonstrate that (1) the MITM attack on VoIP is much more realistic than previously thought; (2) securing all nodes along the path of VoIP traffic is not adequate to prevent MITM attack on VoIP; (3) vulnerabilities of non-VoIP-specific protocols (e.g., DNS) can indeed lead to compromise of VoIP.
---
paper_title: OntoSPIT: SPIT management through ontologies

paper_content:

VoIP enables new ways for communication. At the same time, it provides new means, in terms of transmitting bulk unsolicited messages and calls, namely SPam over Internet telephony (SPIT). In this paper, we propose a conceptual model, based on an underlying ontology, which describes the SPIT domain. The ontology provides capabilities, such as modeling the SPIT phenomenon in a SIP-based VoIP environment, a common understanding of SPIT domain, as well as reusable SPIT-related knowledge interoperability, aggregation and reasoning. We demonstrate that the proposed ontology, combined with a set of SPIT identification criteria, as its underlying axioms and rules, could enhance the correlation and management of SPIT incidents. It could also support SPIT detection, thus facilitating the better protection of VoIP environments in a holistic, cooperative, and effective way.
---
paper_title: CPU-based DoS attacks against SIP servers

paper_content:

A key component of VoIP networks is the SIP signaling infrastructure. The reliance of public SIP servers on the Internet has opened up this critical infrastructure to a range of attacks. In particular, Denial of Service (DoS) attacks pose a serious security threat to the quality, reliability and availability of VoIP operations. In this paper, we investigate the impact of DoS attacks on SIP infrastructure, using a popular open source SIP server as a test bed. We have identified four attack scenarios that can exploit vulnerabilities in existing SIP authentication protocols, and we demonstrate the practical impact of these attacks on the target server. In response to these vulnerabilities, we have proposed several countermeasures to defend against each attack scenario. Our experimental results show that the current SIP implementation is highly vulnerable to DoS attacks and countermeasures are needed to make these servers more resilient. More importantly, we prove that authentication alone is no defence against DoS attacks in this context, and can actually increase the vulnerability of target servers instead of solving the problem of DoS attacks.
---
paper_title: Utilizing bloom filters for detecting flooding attacks against SIP based services

paper_content:

Any application or service utilizing the Internet is exposed to both general Internet attacks and other specific ones. Most of the times the latter are exploiting a vulnerability or misconfiguration in the provided service and/or in the utilized protocol itself. Consequently, the employment of critical services, like Voice over IP (VoIP) services, over the Internet is vulnerable to such attacks and, on top of that, they offer a field for new attacks or variations of existing ones. Among the various threats-attacks that a service provider should consider are the flooding attacks, at the signaling level, which are very similar to those against TCP servers but have emerged at the application level of the Internet architecture. This paper examines flooding attacks against VoIP architectures that employ the Session Initiation Protocol (SIP) as their signaling protocol. The focus is on the design and implementation of the appropriate detection method. Specifically, a bloom filter based monitor is presented and a new metric, named session distance, is introduced in order to provide an effective protection scheme against flooding attacks. The proposed scheme is evaluated through experimental test bed architecture under different scenarios. The results of the evaluation demonstrate that the required time to detect such an attack is negligible and also that the number of false alarms is close to zero.
---
paper_title: Two layer Denial of Service prevention on SIP VoIP infrastructures

paper_content:

The emergence of Voice over IP (VoIP) has offered numerous advantages for end users and providers alike, but simultaneously has introduced security threats, vulnerabilities and attacks not previously encountered in networks with a closed architecture like the Public Switch Telephone Network (PSTN). In this paper we propose a two layer architecture to prevent Denial of Service attacks on VoIP systems based on the Session Initiation Protocol (SIP). The architecture is designed to handle different types of attacks, including request flooding, malformed message sending, and attacks on the underlying DNS system. The effectiveness of the prevention mechanisms have been tested both in the laboratory and on a real live VoIP provider network.
---
paper_title: Peer-to-Peer VoIP communications using anonymisation overlay networks

paper_content:

Nowadays, Voice over Internet Protocol (VoIP) which enables voice conversation remotely over packet switched networks gains much attentions for its low costs and flexible services. However, VoIP calling anonymity, particularly to withhold “who called whom”, is difficult to achieve since VoIP infrastructures are usually deployed in an open networking environment (e.g., the Internet). Our work studies an anonymisation overlay network (AON) based solution to prevent surveillance from external attackers, who are able to wiretap the communication channels as well as to manipulate voice packets in the channels. However, it has been demonstrated that the VoIP combined with traditional AONs are vulnerable to two attacks, namely watermark attack and complementary matching attack. Taking these two attacks into account, we investigate the “defensive dropping” method in VoIP: A VoIP user-agent sends packets to an AON in a constant rate, but packets during periods of silence are marked. Then, the AON drops some silence packets and forwards the remaining ones to their destinations. The result of our experiments shows that the dropping rate must be carefully selected to counteract both of the two attacks. Finally, we discuss further threats in terms of this solution.
---
paper_title: Non-Repudiation in Internet Telephony

paper_content:

We present a concept to achieve non-repudiation for natural language conversations over the Internet. The method rests on chained electronic signatures applied to pieces of packet-based, digital, voice communication. It establishes the integrity and authenticity of the bidirectional data stream and its temporal sequence and thus the security context of a conversation. The concept is close to the protocols for Voice over the Internet (VoIP), provides a high level of inherent security, and extends naturally to multilateral non-repudiation, e.g., for conferences. Signatures over conversations can become true declarations of will in analogy to electronically signed, digital documents. This enables binding verbal contracts, in principle between unacquainted speakers, and in particular without witnesses. A reference implementation of a secure VoIP archive is exists.
---
paper_title: Pr2-P2PSIP: Privacy Preserving P2P Signaling for VoIP and IM

paper_content:

In the last few years, there has been a good deal of effort put into the research and standardization of P2P-based VoIP signaling, commonly called P2PSIP. However, there has been one important issue which has not been dealt with adequately, privacy. Specifically i) location privacy, and ii) privacy of social interaction in terms of who is communicating with whom. In this paper, we present Pr2-P2PSIP, a Privacy-Preserving P2PSIP signaling protocol for VoIP and IM. Our contribution is primarily a feasibility study tackling the privacy issues inherent in P2PSIP. We leverage standard security protocols as well as concepts and experiences learned from other anonymization networks such as Tor and I2P where applicable. We present the design and on-going implementation of Pr2-P2PSIP and provide a threat analysis as well as an analysis of the overhead of adding privacy to P2PSIP networks. Particularly we analyze cryptographic overhead, signaling latency and reliability costs.
---
paper_title: Detecting flooding attacks against IP Multimedia Subsystem (IMS) networks

paper_content:

The IP multimedia subsystem (IMS) is an open IP based service infrastructure that enables an easy deployment of new rich multimedia services mixing voice and data. The IMS is considered as a next generation service delivery platform (SDP) on top of different wireless and wire line access networks. It is based on the session initiation protocol (SIP) which is gaining more and more acceptance in the VoIP market. As an emerging technology, the SIP standard will certainly be the target of denial of service (DoS) attacks and consequently IMS will also inherit this problem. Therefore, it is very important to protect IMS resources from DoS threats. In this paper, we suggest an efficient solution for protecting the IMS networks from such attacks.
---
paper_title: A secure and lightweight scheme for media keying in the session initiation protocol (SIP): work in progress

paper_content:

Exchanging keys to encrypt media streams in the Session Initiation Protocol (SIP) has proved challenging. The challenge has been to devise a key transmission protocol that preserves the features of SIP while minimizing key exposure to unintended parties and eliminating voice clipping. We first briefly survey the two IETF SIP media keying protocols -- SDES and DTLS-SRTP -- and evaluate them against a core feature set. We then introduce a novel simple and lightweight scheme to significantly increase the security of SDES SIP keying with minimal overhead costs. Our proposed key exchange involves only one symmetric key operation by sender and receiver and is secure against the Man-in-the-middle attack unless the attacker is able to intercept both the SIP signaling and media plane traffic. Our key exchange scheme is much simpler than DTLS-SRTP; in fact, compared to SDES, it includes only one additional simple step. At the same time, it provides significantly better security than SDES and is only slightly weaker than the non-PKI version of DTLS-SRTP.
---
paper_title: H.: Secure SIP: A Scalable Prevention Mechanism for DoS Attacks on SIP Based VoIP Systems

paper_content:

Traditional perimeter security solutions cannot cope with the com-plexity of VoIP protocols at carrier-class performance. We implemented a large-scale, rule-based SIP-aware application-layer-firewall capable of detect-ing and mitigating SIP-based Denial-of-Service (DoS) attacks at the signaling and media levels. The detection algorithms, implemented in a highly distributed hardware solution leveraged to obtain filtering rates in the order of hundreds of transactions per second, suggest carrier class performance. Firewall performs SIP traffic filtering against spoofing attacks; and request, response and out-of-state floods. The functionality and performance of the DoS prevention schemes were validated using a distributed test-bed and a custom-built, automated testing and analysis tool that generated high-volume signaling and media traffic, and performed fine grained measurements of filtering rates and load-induced delays of the system under test. The test-tool included SIP-based attack vectors of spoofed traffic, as-well-as floods of requests, responses and out-of-state message sequences. This paper also presents experimental results.
---
paper_title: Using Cryptographically Generated SIP-URIs to Protect the Integrity of Content in P2P-SIP

paper_content:

Alkylation of aromatic compounds employing novel crystalline porous magnesium silicates having catalytic activity.
---
paper_title: Detecting VoIP based DoS attacks at the public safety answering point

paper_content:

In the recent years Voice over IP (VoIP) telephony started to migrate from research to the market. In the future, All-IP networks will substitute the classical Public Switched Telephone Networks (PSTNs). Nowadays, there is no All-IP network yet, but many VoIP-providers already enable calls from VoIP to a PSTN and vice versa. Thus, critical infrastructures within the PSTN like the emergency call service, are accessible from the VoIP network (e.g. the Internet) and get exposed to new security threats. In particular, there is the risk of Denial of Service (DoS) attacks originating from the VoIP network. An attacker could jam the emergency call service by generating a massive load of faked emergency calls, which could lead to the loss of lives in the worst case. For us, this was the motivation to analyse the applicability of the concept of Intrusion Detection (ID) in the emergency call context and develop an adapted ID-architecture including its implementation. In an evaluation of the ID-architecture, using real emergency call traces from the fire department of Cologne, we show that the developed concept can reliably detect emerging DoS attacks from VoIP networks up to a certain VoIP diffusion rate.
---
paper_title: Application of evolutionary algorithms in detection of SIP based flooding attacks

paper_content:

The Session Initiation Protocol (SIP) is the de facto standard for user's session control in the next generation Voice over Internet Protocol (VoIP) networks based on the IP Multimedia Subsystem (IMS) framework. In this paper, we first analyze the role of SIP based floods in the Denial of Service (DoS) attacks on the IMS. Afterwards, we present an online intrusion detection framework for detection of such attacks. We analyze the role of different evolutionary and non-evolutionary classifiers on the classification accuracy of the proposed framework. We have evaluated the performance of our intrusion detection framework on a traffic in which SIP floods of varying intensities are injected. The results of our study show that the evolutionary classifiers like sUpervised Classifier System (UCS) and Genetic clASSIfier sySTem (GAssist) can even detect low intensity SIP floods in realtime. Finally, we formulate a set of specific guidelines that can help VoIP service providers in customizing our intrusion detection framework by selecting an appropriate classifier-depending on their requirements in different service scenarios.
---
paper_title: A Distributed Key-Changing Mechanism for Secure Voice Over IP (VoIP) Service

paper_content:

Voice over IP (VoIP) has experienced tremendous growth in recent years due to its low cost and flexible service enhancement. However, it is vulnerable to security attack. The most popular solution to providing secure VoIP service is based on the advanced encryption standard (AES). The practice for AES-based solution is to adopt a common secret key negotiated during a VoIP call setup phase. This single common key solution is, however, vulnerable to many kinds of attacks. In this paper, we propose a distributed multi-key solution which dynamically changes the encryption key based on the Diffie-Hellman algorithm to provide more secure protection for an end-to-end VoIP call. The proposed mechanism does not need to renegotiate new keys during a call and is robust to network dynamics and packet losses. Most importantly, it incurs small delay overhead comparable to the solutions with encryption protection. The performance of the proposed mechanism is evaluated via laboratory experiment, and validated by some security analysis.
---
paper_title: Sketch-Based SIP Flooding Detection Using Hellinger Distance

paper_content:

The Voice over IP (VoIP) application utilizes the Internet to provide voice service; thus it is susceptible to various security issues common on the IP networks, such as the flooding attack. Moreover, VoIP uses the Session Initiation Protocol (SIP) for session control and management. The transactional nature of SIP makes flooding attack an even severer threat, which can consequentially lead to denial of service (DoS). In this paper, we develop an efficient online SIP flooding detection scheme by integrating the sketch technique with Hellinger distance (HD) based detection. The sketch data structure can summarize the SIP call generating process into a fixed set of data for developing a probability model. The HD technique, combined with on-line traffic estimation, can efficiently identify attacks by monitoring the distance between current traffic distribution and the estimated distribution based on history information. Compared to the original HD detection system, our technique achieves the advantages of higher accuracy, flexibility to deal with multi-attribute attacks and DDoS attacks, and the ability to track the period of attack. Computer simulation results are presented to demonstrate the performance of the proposed technique.
---
paper_title: Secure Mobile VoIP

paper_content:

The rapid growth of computing, the Internet and telecommunications systems have resulted in a broad range of ways to communicate and access information. Voice over Internet Protocol (VoIP) is a Computer Telephony Integration (CTI) solution that transports voice traffic over a data network as an alternative to the Plain Old Telephone Service (POTS). VoIP products promise converged telecommunications and data services that are cheaper, more versatile and provide higher voice quality as compared to traditional offerings. Although VoIP products are rapidly gaining market share with home users, uptake in the enterprise market has remained slow as a result of security and mobility concerns. This paper addresses the issues surrounding VoIP security and mobility through the integration of robust security features into a lightweight VoIP protocol that is tailored for mobile devices. A theoretical approach is realized with the development of a software prototype whose security and mobility properties are analyzed.
---
paper_title: Attack analysis & bio-inspired security framework for IP multimedia subsystem

paper_content:

This paper analyzes the security vulnerabilities and requirements of IP Multimedia Subsystem(IMS), particularly the impact of Denial-of-Service(DoS) and Distributed DoS(DDoS) attacks on the IMS. We propose and develop an intelligent Bio-inspired, self-defending security framework for the IMS and Next Generation all-IP Networks. Our proposed framework will complement the existing authentication and encryption mechanisms to protect infrastructure nodes and subscribers against the attacks launched by the malicious nodes in the network. This framework is expected to become a cardinal component which can be integrated into any IMS converged network infrastructure to provide defense against wide variety of attacks particularly DoS and DDoS attacks.
---
paper_title: Anti-vamming trust enforcement in peer-to-peer VoIP networks

paper_content:

With the increasing popularity of Voice over IP (VoIP) the threat of "vamming" or VoIP spam calls is looming large over the telecom industry. This threat arises out of the "openness" of the IP-based network such as the Internet, which enables anyone to join the network without proving reasonable trustworthiness. Although this problem could be solved satisfactorily in managed networks, it proves to be a nightmare in distributed, unmanaged peer-to-peer (p2p) networks. A possible approach to solve this problem, at least to a certain extent, is to associate some level of trust with each p2p entity. In this paper, we propose a trust enforcement framework consisting of computation and memory bound functions that associate trust implicitly to the p2p VoIP entities. Based on this trust, one can judiciously decide whether a call from a p2p VoIP entity could be accepted or not, thus implementing a preliminary screening mechanism for malicious callers.
---
paper_title: Finding "Who Is Talking to Whom" in VoIP Networks via Progressive Stream Clustering

paper_content:

Technologies that use the Internet network to deliver voice communications have the potential to reduce costs and improve access to communications services around the world. However, these new technologies pose several challenges in terms of confidentiality of the conversations and anonymity of the conversing parties. Call authentication and encryption techniques provide a way to protect confidentiality, while anonymity is typically preserved by an anonymizing service (anonymous call). This work studies the feasibility of revealing pairs of anonymous and encrypted conversing parties (caller/callee pair of streams) by exploiting the vulnerabilities inherent to VoIP systems. In particular, by exploiting the aperiodic inter-departure time of VoIP packets, we can trivialize each VoIP stream into a binary time-series. We first define a simple yet intuitive metric to gauge the correlation between two VoIP binary streams. Then we propose an effective technique that progressively pairs conversing parties with high accuracy and in a limited amount of time. Our metric and method are justified analytically and validated by experiments on a very large standard corpus of conversational speech. We obtain impressively high pairing accuracy that reaches 97% after 5 minutes of voice conversations.
---
paper_title: Specification-Based Denial-of-Service Detection for SIP Voice-over-IP Networks

paper_content:

Security threats for voice-over IP (VoIP) networks are becoming a major concern as its popularity increases. New attacks are developed that target directly the underlying SIP protocol. To detect such kinds of attacks we present a specification-based detection framework to recognise deviation from its expected behaviour. We present an implementation and show with measurements that this method is capable of attack detection and mitigation for different kinds of attacks directed towards a SIP infrastructure, including denial-of-service message flooding.
---
paper_title: Denial of service attack and prevention on SIP VoIP infrastructures using DNS flooding

paper_content:

A simple yet effective Denial of Service (DoS) attack on SIP servers is to flood the server with requests addressed at irresolvable domain names. In this paper we evaluate different possibilities to mitigate these effects and show that over-provisioning is not sufficient to handle such attacks. As a more effective approach we present a solution called the DNS Attack Detection and Prevention (DADP) scheme based on the usage of a non-blocking DNS cache. Based on various measurement conducted over the Internet we investigate the efficiency of the DADP scheme and compare its performance with different caching strategies applied.
---
paper_title: Identity federation for voip-based services

paper_content:

Identity Federation enables managing a single User's multiple Identities across administrative domains. Instead of forcing a single Identity for the User, it leverages trust between Service Providers to share User Identity information viz. Authentication, Authorization and Attributedetails. Users can federate their multiple Identities at different domains, for combined cross-domain benefits such as Single Sign On(SSO) on the Internet. In this paper, we analyze and present how the power of Identity Federation can be used within VoIP, to offer a more flexible and capable service environment to the User. Also, Identity Federationcan save VoIP, from any impending challenges of "Identity multiplicity" arising from the presence of numerous Service Providers. We select the Session Initiation Protocol (SIP) and argue that in order to achieve its true potential of a pervasive VoIP platform, SIP needs a way for supporting "mobility across multiple User Identities". The paperanalyzes differences in introducing Identity Federation for VoIP, as compared to HTTP-based services and identifies additional benefits that are possible for VoIP entities. An important aspect is that of user control over Identity Federation enablement and usage, keeping in line with the SIP design philosophy. We propose a user-controlled Identity Federation sub-layer within SIP, so that federation benefitscan be leveraged to all kinds of multimedia applications. We also present a set of exemplary yet novel use-cases enabled by the framework.
---
paper_title: A SIP-oriented SPIT Management Framework

paper_content:

Voice over IP (VoIP) telephony is increasingly gaining popularity among home and business users alike, as a viable alternative to traditional telephony, and is expected to achieve a significant market share in the near future. When this happens, it is also expected that several new threats exploiting the Internet vulnerabilities will appear. One of these is the Spam over Internet Telephony (SPIT). This paper examines in detail the SPIT attack, provides a review and assessment of previously proposed SPIT management techniques and proposes the use of an attack-oriented methodology for thwarting the SPIT threat. This results in a generic SPIT management framework, which combines the strengths of existing solutions, while alleviating their insufficiencies.
---
paper_title: Progressive multi gray-leveling: a voice spam protection algorithm

paper_content:

As voice over IP gains popularity, it is easy to imagine that Internet hacking and other security problems we currently face with email spam will attack the VoIP environment. In contrast to email protocols represented by SMTP, VoIP does not tolerate any negotiation in its signaling steps or screening content due to the delay limitation. Thus, it is difficult to implement voice spam protection or control algorithms by just mimicking popular email spam protection algorithms. This article proposes a voice spam control algorithm called progressive multi gray-leveling (PMG) that fits in VoIP settings. PMG progressively calculates the "gray level" of a caller and determines whether the call will be connected or blocked based on previous call patterns. Based on experiments, it turns out that PMG can learn a spammer's calling pattern and block massive spam attacks from them effectively
---
paper_title: Intrusion Detection System for Denial-of-Service flooding attacks in SIP communication networks

paper_content:

Security threats to Voice-over IP (VoIP) or IP Multimedia Subsystem (IMS) networks are becoming a major concern as their popularity increases. New attacks are being developed that directly target the underlying SIP protocol. To detect such kinds of attacks we are presenting a specification-based Intrusion Detection System (IDS) to recognise deviation from its expected protocol behaviour. We will present an implementation and show with measurements that this method is capable of attack detection and mitigation for different kinds of attacks directed towards a SIP infrastructure, with a focus on Denial-of-Service (DoS) message flooding.
---
paper_title: Performance Evaluation of a Flooding Detection Mechanism for VoIP Networks

paper_content:

The Internet based telephony services (IPTel) are mainly exposed to set of vulnerabilities that inherited from the employed protocols such as TCP/IP and proprietary VoIP protocols. One of the most critical threats in this sensitive environments is considered the denial of service (DoS) attacks. The main concern of a mechanism that focuses on detecting such attacks is the potential end-to-end delay between communicating parties. In this paper is described a hash based flooding detection mechanism and evaluated in an experimental test bed architecture. The outcomes demonstrate the potentiality of the mechanism as the end-to-end delay is negligible.
---
paper_title: An assessment of VoIP covert channel threats

paper_content:

A VoIP covert channel is a mechanism that utilizes an IP phone conversation to illicitly transfer information across a network. In this paper, we present a model of VoIP covert channels that explains their main components and functions. We provide a performance evaluation framework, and quantify the threat to users. Our results demonstrate that covert channels represent an immediate threat to VoIP users. We discuss possible course of actions to detect attacks and mitigate the risk of information leakage.
---
paper_title: On the anonymity and traceability of peer-to-peer VoIP calls

paper_content:

Voice over Internet protocol is a technology that enables people to use the Internet, rather than the traditional public switched telephone network, as the transmission medium for voice communications. VoIP is becoming increasingly popular due to its significant advantages in cost and flexible features compared with the plain old telephone system. The proliferation of VoIP calls has significant implications on the security and privacy aspects of voice calls. For example, the use of VoIP has made it much easier to achieve confidentiality and anonymity in voice communications. On the other hand, VoIP has imposed significant new challenges in providing the same call-identifying and wiretapping capabilities as those that exist in traditional circuit-switched networks. In this article we examine the privacy and security aspects of peer-to-peer (P2P) VoIP calls and show how the use of VoIP has substantially shifted the previous balance between privacy and security that exists in traditional PSTN calls. In particular, we show that the use of strong encryption and available low-latency anonymizing network at the same time does not necessarily provide the level of anonymity to VoIP that people would intuitively expect
---
paper_title: A Mechanism for Ensuring the Validity and Accuracy of the Billing Services in IP Telephony

paper_content:

The current penetration, but also the huge potential, of Voice over IP (VoIP) telephony services in the market, boosts the competition among telecommunication service providers who promote new services through many different types of offers. However, this transition from the closed Public Switched Telephone Network (PSTN) architecture to the internet based VoIP services, has resulted in the introduction of several threats both intrinsic i.e. VoIP specific, and Internet oriented. In the framework of this paper, we are considering threats that may affect the accuracy and validity of the records of the billing system that the service provider is using for charging the users. We are proposing a simple, practical and effective mechanism for protecting telecommunication service providers and end users from malicious activities originated from the end users and telecommunication service providers respectively. In both cases the malicious activity concerns fraud through the billing system. The proposed mechanism focuses on VoIP services that are based on the Session Initiation Protocol (SIP). However, it can be easily amended to cover other VoIP signaling protocols, as it takes advantage of the underlying AAA network infrastructure to deliver robust time stamping services to SIP network entities.
---
paper_title: SIP digest authentication relay attack

paper_content:

The Session Initiation Protocol (SIP [RFC3261]) provides a mechanism ::: for creating, modifying, and terminating sessions with one or more ::: participants. This document describes a vulnerability of SIP combined ::: with HTTP Digest Access Authentication [RFC2617] through which an ::: attacker can leverage the victim's credentials to send ::: authenticated requests on his behalf. This attack is different from ::: the man-in-the-middle (MITM) attack and does not require any ::: eavesdropping, DNS or IP spoofing.
---
paper_title: Specification-based intrusion detection for H.323-based voice over IP

paper_content:

Voice over IP (VoIP) has been in a state of rapid development due to its economical advantage over traditional telephone services. Denial of service (DoS) attack has been a major security threat for many computer systems. This work introduces a specification-based intrusion detection system to protect H.323 gatekeepers from both external and internal DoS attacks. Based on the protocol for RAS (Registration, Admission Status) messages, a finite-state machine specification for correct behaviors between a gatekeeper and endpoints is produced. Security requirements against these DoS attacks are established, resulting in a formal protocol specification for secured gatekeepers. Developing the proposal into a practical solution, an intrusion detection module is built and incorporated into the open source software GNU Gatekeeper (also named OpenH323GK). A simple, proof-of-concept prototype has been built; the secured H. 323 gateway is able to fend off DoS attacks launched from GNU OpenPhone clients
---
paper_title: New security and control protocol for VoIP based on steganography and digital watermarking

paper_content:

In this paper new, lightweight security and control protocol for Voice over Internet Protocol (VoIP) service is presented. It is the alternative for the IETF's (Internet Engineering Task Force) RTCP (Real-Time Control Protocol) for real-time application's traffic. Additionally this solution offers authentication and integrity of voice send and it is capable of exchanging and verifying QoS and security parameters. It is based on two information hiding techniques: digital watermarking and steganography. That is why it does not consume additional bandwidth and the data transmitted is inseparably bound to the voice content.
---
paper_title: Abusing SIP Authentication

paper_content:

The recent and massive deployment of voice over IP infrastructures had raised the importance of the VoIP security and more precisely of the underlying signalisation protocol SIP. In this paper, we will present a new attack against the authentication mechanism of SIP. This attack allows to perform toll fraud and call hijacking. We will detail the formal specification method that allowed to detect this vulnerability, highlight a simple usage case and propose a mitigation technique.
---
paper_title: Covert Channel for Improving VoIP Security

paper_content:

In this paper a new way of exchanging data for Voice over Internet Protocol (VoIP) service is presented. With use of audio watermarking and network steganography techniques we achieve a covert channel which can be used for different purposes e.g. to improve IP Telephony signaling protocol’s security or to alternate existing protocols like RTCP (Real-Time Control Protocol). In this paper we focus on improving VoIP security. The main advantage of this solution is that it is lightweight (it does not consume any transmission bandwidth) and the data sent is inseparably bound to the voice content.
---
paper_title: A survey of VoIP intrusions and intrusion detection systems

paper_content:

This paper presents a survey of the security problems in VoIP networks, with an emphasis on both intrusions and intrusion detection methods. It examines the intrusion issues in different components of VoIP systems, points to the strengths and shortcomings in the existing intrusion detection methods and intrusion detection systems and suggests possible future research directions.
---
paper_title: Security Issues and Solutions for Voice over IP compared to Circuit Switched Networks

paper_content:

The plunger of a latching control button is held in its retracted position by a latching ring which is rotatable about the axis of the system and releases the plunger when the control member is depressed.
---
paper_title: Voice over IP: Risks, Threats and Vulnerabilities

paper_content:

Voice over IP (VoIP) and Internet Multimedia Subsystem (IMS) technologies are rapidly being adopted by consumers, enterprises, governments and militaries. These technologies offer higher flexibility and more features than traditional telephony (PSTN) infrastructures, as well as the potential for lower cost through equipment consolidation and, for the consumer market, new business models. However, VoIP/IMS systems also represent a higher complexity in terms of architecture, protocols and implementation, with a corresponding increase in the potential for misuse. Here, we begin to examine the current state of affairs on VoIP/IMS security through a survey of known/disclosed security vulnerabilities in bug-tracking databases. This paper should serve as a starting point for understanding the threats and risks in a rapidly evolving set of technologies that are seeing increasing deployment and use. Our goal is to gain a better understanding of the security landscape with respect to VoIP/IMS, toward directing future research in this and other similar emerging technologies.
---
paper_title: The security challenges inherent in VoIP

paper_content:

VoIP offers unparalleled flexibility for users, but with that flexibility also come security concerns. Moving both the control and data channels to IP opens the doors to new types of attack not seen before on phone systems.
---
paper_title: Analysis of Techniques for Protection Against Spam over Internet Telephony

paper_content:

Spam in Internet telephony (SPIT) networks is likely to become a large problem in the future, as more and more people and companies switch from traditional telephone networks to Voice over IP (VoIP) networks, and as it is easy to spam VoIP users. The goal of this survey paper is to identify techniques to prevent and reduce SPIT. To compare the various SPIT protection techniques, criteria will be presented that must be met by these techniques. We also identify several combinations of techniques that complement each other, to increase the protection effectiveness.
---
paper_title: Vulnerability analysis and best practices for adopting IP telephony in critical infrastructure sectors

paper_content:

IP telephony has been rapidly introduced to replace the traditional circuit switched infrastructure for telephony services. This change has had an enormous impact on critical-infrastructure (CI) sectors, which are expected to become increasingly dependent on IP telephony services. Reliable and secure telephony service is a key concern confronting most organizations in the critical-infrastructure sector today. With the proliferation of voice over IP (VoIP) services in these organizations, it is important for them to understand the security vulnerabilities and come up with a set of best practices during the evolution of the IP telephony services. This article outlines the potential security issues faced by CI sectors as they transform their traditional phone systems into VoIP systems. Vulnerability analyses are conducted to understand the impact of VoIP security challenges in the new convergent network paradigm. The most common security measures are analyzed to identify their strengths and limitations in combating these new security challenges. A set of recommendations and best practices are offered to address the key issues of VoIP security as IP telephony is being introduced into critical infrastructure.
---
paper_title: Security issues around the deployment of VoIP and multimedia protocols in wireless and firewalled environments

paper_content:

The recent increase of geographically dispersed users and telecommuting has given rise to greater requirements for better methods of collaboration and interaction between personnel. This has increased the prevalence of technologies such as Voice over Internet Protocol (VoIP) and multimedia protocols such as video-conferencing, Web-casting and Instant Messaging. The capabilities of the Internet and many private networks have ensured that all these functions are able to run across existing infrastructure, encouraging network convergence and reducing costs. However, implementing these applications in firewalled environments and over wireless networks poses a number of security issues, which need to be addressed as part of any such deployment.
---
paper_title: Threat assessment of IP based voice systems

paper_content:

In this paper, we will provide an analysis of the potential threats to the reliability and security of IP based voice systems including; voice over IP and IP telephony. For each of the threat categories we will explore the potential methods of attacks and detail various mitigation approaches. These mitigation approaches may help to minimize or eliminate the exposure. Finally, we will provide a set of summary recommendations for dealing with each of the threat categories.
---
paper_title: A Survey and Analysis of Media Keying Techniques in the Session Initiation Protocol (SIP)

paper_content:

Exchanging cryptographic keys to encrypt the media stream in the Session Initiation Protocol ({SIP}) has proven difficult. The challenge is to effectively exchange keys while preserving the features of the protocol (e.g., forking, re-targeting, request recursion, etc.), minimizing key exposure to unintended parties, eliminating voice clipping, maintaining end-to-end key privacy, interfacing with PSTN, etc. In this paper, we survey three key management protocols - SDES, ZRTP and DTLS-SRTP - that have been proposed for media keying, and evaluate them for use with SIP. To aid in the evaluation, we first extract (and justify) a core feature set from SIP. We then survey each key management protocol in detail and proceed to analyze the cores of the three protocols against this feature set to annotate their weaknesses and strengths.
---
paper_title: Challenges in securing voice over IP

paper_content:

Although VoIP offers lower cost and greater flexibility, it can also introduce significant risks and vulnerabilities. This article explains the challenges of VoIP security and outlines steps for helping to secure an organization's VoIP network.
---
paper_title: Security Issues in VOIP Applications

paper_content:

Recent Voice over Internet Protocol (VoIP) technology is attracting more and more attention and interest in the industry. VoIP applications such as IP telephony systems involve sending voice transmissions as data packets over private or public IP networks as well as reassembled and decoded on the receiving side. Security concerns are always the major barrier that prevents many businesses from employing VoIP technologies. In this paper, we discuss various VoIP security threats and possible approaches to tackle the threats in VoIP applications.
---
paper_title: Voice over IP: security pitfalls

paper_content:

Voice over IP (VoIP) is being embraced at a rapid rate. But for a business the decision to implement is complicated. The verdict needs to take into account network capacity, possible equipment upgrades and staffing and training costs. VoIP opens a company up to many security risks such as loss of service, DoS and compromise and eavesdropping among other risks. VoIP is being taken up at a significant rate. Most visibly, VoIP eliminates the notion of a long-distance call. Any service on an IP network faces the usual IP risks. VoIP opens telephony up to a different, cheaper avenue of attack, essentially expanding the perimeter.
---
paper_title: Multiple design patterns for voice over IP (VoIP) security

paper_content:

Design patterns capture software solutions to specific problems that have evolved over time and reflect many iterations of work. Documenting such patterns promotes proven design and software reuse. There has been a growing amount of work documenting design patterns for security, however, little work specific to VoIP security. In 2005 NIST released a report on recommendations and best practices for securing VoIP, however it lacks the structure, terminology, and ease-of-understanding needed for both technical and non-technical audiences that is an inherent feature of design patterns. In this paper, we document three design patterns for VoIP implementations related to specific security problems: (1) secure traversal of firewalls and NATs; (2) detecting and mitigating DDoS attacks; and (3) securing against eavesdropping. With many VoIP vendors rushing products to market with overlapping functionality and requirements for interoperability, documenting design patterns is poised to become an important part of secure programming processes for VoIP.
---
paper_title: An overview of some techniques to exploit VoIP over WLAN

paper_content:

Voice over IP (VoIP) is one of the most emerging technologies, with a very relevant market penetration trend. This technology will represent a cost advantage for the business and private networks with greater flexibility, if no new related vulnerabilities are introduced. The problems of security of the VoIP are mainly related to the weaknesses of the combination of the SIP and RTP protocols. In the VoWiFi case, these weaknesses are enhanced by the intrinsic vulnerabilities of the first generation wireless networks (802.11b), or by a bad administration of wireless security systems. After building a VoIP network over Wi- Fi without enforcing security measures for the authentication and the privacy of the data, we will show in this paper several typologies of attack: Eavesdropping and Sniffing of the VoIP calls, Man in the Middle, Denial of Service, Call interruption and Build false calls. All these threats can represent part of a check list for a plug-andplay penetration test schedule, whenever a company deploys a VoIP network infrastructure based on some untested VoIP softphone and Wireless Lan (as an internal hotspot).
---
paper_title: A Look at VoIP Vulnerabilities

paper_content:

Voice over IP (VOIP) and Internet Multimedia Subsystem (IMS) technologies offer higher flexibility than traditional telephony infrastructures and the potential for lower cost through equipment consolidation and new business models. In this article, I examined the current state of affairs on VOIP/IMS security through a survey of all the 221 kown/disclosed security vulnerabilities in the Common vulnerabilities and Exposure (CVE) database and in IETF RFCs/drafts. My key finding is than the higher complexity of VOIP/IMSsystems leads to a variety of attcks vectors, many of them caused by unforeseen and unexpected components interactions. A second finding is that what people seem to worry about in VOIP (traffic interception and impresionation) bears no resemblance to the distribution of vulnerabilities actually disclosed. The article concludes with some practical suggestions for securing VOIP systems.
---
paper_title: Overview of security issues of VOIP

paper_content:

As an IP application, Voice over the Internet Protocol is vulnerable to a number of attacks. Security is an essential consideration for VoIP providers since each component in the VoIP infrastructure can be used as a target, and VoIP has specific security challenges as well. Firstly, this paper discusses general aspects of VoIP. Secondly, the paper addresses these aspects to discuss security issues and concerns of this new technology. Finally, the paper considers some security challenges that VoIP systems are facing.
---
paper_title: Network Security – Is IP Telephony Helping The Cause?

paper_content:

The major players in the Public Branch Exchange (PBX) market are moving rapidly towards the implementation of IP Telephony. What will be the effect on network security overall? Will the push to IP Telephony damage the good work already devoted to security networks? As more doorways open up on our networks there is an increased chance we have opened another unseen vector for hackers and other malicious organisation or individuals to access the data stored on server and users workstations, corrupting that data or destroying it. Is it better from a security perspective to have IP telephony only between PBX equipment – a significant saving in itself or is it imperative that an organisation have IP telephony to the desktop? Is there any real difference, once IP Telephony is past the network boundary does it matter if it also appears at the desktop? What about the future with collaboration and unified collaboration? This paper will discuss a number of implementations and attempt to understand the pros and cons of each. No one solution is going to fit all networks but hopefully this paper will be able to increase our understanding of the dangers and therefore allow for the development of robust solutions.
---
paper_title: Vulnerabilities and Security Limitations of current IP Telephony Systems

paper_content:

Within the traditional telephone system a certain level of quality and security has been established over the years. If we try to use IP Telephony systems as a core part of our future communication infrastructure (e.g. as classical PBX enhancement or replacement) continuous high availability, stable and error-free operation and the protection of the privacy of the spoken word are challenges, that definitely have to be met. Since manufacturers start deploying new end systems and infrastructure components rather fast now - a critical inspection of their security features and vulnerabilities is mandatory. The critical presentation of the theoretical background of certain vulnerabilities, testing and attacking tools and the evaluation results reveals, that well-known security flaws become part of implementations in the new application area again and the security level of a number of examined solutions is rather insufficient.
---
paper_title: Security Challenge and Defense in VoIP Infrastructures

paper_content:

Voice over Internet protocol (VoIP) has become a popular alternative to traditional public-switched telephone network (PSTN) networks that provides advantages of low cost and flexible advanced ldquodigitalrdquo features. The flexibility of the VoIP system and the convergence of voice and data networks brings with it additional security risks. These are in addition to the common security concerns faced by the underlying IP data network facilities that a VoIP system relies on. The result being that the VoIP network further complicates the security assurance mission faced by enterprises employing this technology. It is time to document various security issues that a VoIP infrastructure may face and analyze the challenges and solutions that may guide future research and development efforts. In this paper, we examine and investigate the concerns and requirements of VoIP security. After a thorough review of security issues and defense mechanisms, we focus on attacks and countermeasures unique to VoIP systems that are essential for current and future VoIP implantations. Then, we analyze two popular industry best practices for securing VoIP networks and conclude this paper with further discussion on future research directions. This paper aims to direct future research efforts and to offer helpful guidelines for practitioners.
---
paper_title: Security analysis and solutions for deploying IP telephony in the critical infrastructure

paper_content:

Voice over IP (VoIP) is being adopted to replace the traditional circuit switched infrastructure for telephony services. This trend has an enormous impact on the critical infrastructure sectors which will progressively become more dependent in part or as a whole on VoIP services. Phone communications and its security is a relevant concern for most critical infrastructure sector organizations today. With passage of time this concern will morph into a new set of challenges and opportunities brought forward by the deployment of VoIP in these organizations. This study attempts to outline the potential security issues faced by the critical infrastructure sectors as they transform their traditional phone systems into VoIP systems. Security analysis is provided to understand the impact of VoIP security challenges in the new convergent network paradigm. Some recommendations are made on how to address many issues of VoIP security along the process of adopting IP telephony into critical infrastructure.
---
paper_title: An ontology-based policy for deploying secure SIP-based VoIP services

paper_content:

Voice services over Internet Protocol (VoIP) are nowadays much promoted by telecommunication and Internet service providers. However, the utilization of open networks, like the Internet, raises several security issues that must be accounted for. On top of that, there are new sophisticated attacks against VoIP infrastructures that capitalize on vulnerabilities of the protocols employed for the establishment of a VoIP session (for example the Session Initiation Protocol - SIP). This paper provides a categorization of potential attacks against VoIP services, followed by specific security recommendations and guidelines for protecting the underlying infrastructure from these attacks and thus ensuring the provision of robust and secure services. In order to utilize (share) the aforementioned security guidelines and recommendations into different domains, it is necessary to have them represented in some formal way. To this end, ontologies have been used for representing the proposed guidelines and recommendations in the form of a unified security policy for VoIP infrastructures. This ontology-based policy has been then transformed to a First Order Logic (FOL) formal representation. The proposed ontology-based security policy can be applied in a real VoIP environment for detecting attacks against an SIP-based service, but it can be also utilized for security testing purposes and vulnerabilities identification. The work presented in this paper has been focused to the SIP protocol. However, generalization to other signaling protocols is possible.
---
paper_title: Threat Analysis of the Session Initiation Protocol Regarding Spam

paper_content:

Voice over Internet protocol (VoIP) is becoming increasingly popular due to its significant advantages regarding cost and support of enhanced multimedia services. Despite of the substantial advantages of using the Internet as the transmission medium for voice calls, we can foresee many undesirable uses, especially in terms of spam. VoIP technology may provide new means for the transmission of bulk unsolicited messages and calls (spam over Internet telephony - SPIT), mainly due to the reduced cost compared to traditional telephony. Therefore, mechanisms are essential to address the SPIT problem, while maintaining the advantages of VoIP technology. In this paper we conduct a comprehensive threat analysis that addresses the ascendant VoIP protocol, the session initiation protocol, in terms of its vulnerability regarding SPIT deliverance. Our analysis introduces the requirements that the mechanisms dealing with the SPIT phenomenon should take into account, in order to be feasible and efficient.
---
paper_title: Protecting SIP-Based Networks and Services from Unwanted Communications

paper_content:

In recent times, SIP-based communication systems have become more and more popular (e.g., in open networks, NGN, IMS, etc.). With continuously dropping cost for the usage of such systems (e.g., VoIP, IM, IPTV), many researchers anticipate the amount of unsolicited communication within the network to reach an alarming high level in the near future. Thus, protection of such systems is needed to counter this threat. We present a holistic protection framework for SIP based infrastructures and describe the most recent enhancements of the system.
---
paper_title: Denial of service attacks targeting a SIP VoIP infrastructure: attack scenarios and prevention mechanisms

paper_content:

In this article we address the issue of denial of service attacks targeting the hardware and software of voice over IP servers or by misusing specific signaling protocol features. As a signaling protocol we investigate here the session initiation protocol. In this context we mainly identify attacks based on exhaustion of the memory of VoIP servers, or attacks that incur high CPU load. We deliver an overview of different attack possibilities and explain some attacks in more detail, including attacks utilizing the DNS system and those targeting the parser. A major conclusion of the work is the knowledge that SIP provides a wide range of features that can be used to mount DoS attacks. Discovering these attacks is inherently difficult, as is the case with DoS attacks on other IP components. However, with adequate server design, efficient implementation, and appropriate hardware, the effects of a large portion of attacks can be reduced
---
paper_title: SIP Vulnerabilities and Anti-SPIT Mechanisms Assessment

paper_content:

Although VoIP provides new ways of communication, at the same time it offers new possibilities for transmitting bulk unsolicited messages and calls, enabling spam over internet telephony (SPIT). The VoIP prevailing protocol is SIP, which it is vulnerable to threats that allow SPIT to be deployed. In this paper we assess the risk of identified threats and vulnerabilities of the SIP protocol. Then, we conduct an analytical survey of already proposed anti-SPIT techniques and we evaluate their effectiveness, in terms of how they deal with the threats and vulnerabilities. Finally, we complete our evaluation by presenting a theoretical evaluation framework, based on additional qualitative and quantitative criteria.
---
paper_title: SPIT Identification Criteria Implementation: Effectiveness and Lessons Learned

paper_content:

While VoIP enables new means for communication, it may also provide a new way of transmitting bulk unsolicited messages and calls, namely SPam over Internet Telephony (SPIT). In this paper, we present the phases of a SPIT management process and we form a set of SPIT identification criteria, which are needed in order to characterize a call as SPIT, or a caller as spitter. Then, we present briefly the currently existing anti-SPIT frameworks, so as to examine which of the SPIT identification criteria is fulfilled by each framework, thus providing an insight on which criteria a technique should cope with, as well as how one can evaluate and combine existing approaches, in order to effectively mitigate SPIT. Finally, we implement a list of the criteria in our lab environment in order to examine the applicability of these controls in a Session Initiation Protocol (SIP) environment.
---
paper_title: Key Agreement for Secure Voice over IP

paper_content:

This thesis reviews the usual properties and requirements for key agreement protocols. It then focuses on MIKEY, a work-in-progress protocol designed to conduct key agreements for secure multimedia ...
---
paper_title: Stream or Block Cipher for Securing VoIP?

paper_content:

When the network is homogeneous, choosing the cipher type for a packet telephony application is simple. It is clear that stream ciphers perform better than block ciphers over landline, circuit-switched networks, since loss is negligible in these networks but corruption is not. Likewise, it is also clear that block ciphers perform better than stream ciphers over landline, packet-switched networks, since corruption is negligible in these networks but loss is not [9]. However, the choice of cipher is not so clear for a heterogeneous internetwork containing a mix of packet and circuit-switched networks. Additionally, this issue becomes even more confounded when heterogeneous internetwork also consists of wireless links. Existing encryption systems will degrade performance in a heterogeneous internetwork because such internetworks have appreciable loss and corruption. Thus, the error properties would degrade the subjective quality of the packet telephony application. In this paper we present an experimental results of comparing block and stream ciphers when used to secure VoIP in terms of end-to-end delay and subjective quality of perceived voice. We proposed a new technique, which provides automatic synchronization of stream ciphers on a per packet basis, without the overhead of an initialization vector in packet headers or without maintaining any state of past-encrypted data. We show that this technique mitigates the trade-off between subjective quality and confidentiality.
---
paper_title: The Internet Key Exchange (IKE)

paper_content:

ISAKMP ([MSST98]) provides a framework for authentication and key exchange but does not define them. ISAKMP is designed to be key exchange independant; that is, it is designed to support many different key exchanges.
---
paper_title: Performance analysis of secure session initiation protocol based VoIP networks

paper_content:

The commercial deployment of voice over internet protocol (VoIP) networks (and associated packet switching technologies) has gathered pace in the recent years. However, a major concern with such networks is the issue of the security of networks based on such open standards. Little research has been carried out into examining the options for securing VoIP networks and, more specifically, the impact which implementing such security architectures and protocols will have on the performance of such secure networks. This paper describes the research, which has been carried out into the development of a realistic model for carrying out simulations of the performance of secure session initiation protocol based VoIP networks. The results of the performance analysis obtained using this model are presented with a discussion of the implications of these results for designers considering implementation of real secure VoIP networks.
---
paper_title: The Design and Implementation of Datagram TLS

paper_content:

A number of applications have emerged over recent years that use datagram transport. These applications include real time video conferencing, Internet telephony, and online games such as Quake and StarCraft. These applications are all delay sensitive and use unreliable datagram transport. Applications that are based on reliable transport can be secured using TLS, but no compelling alternative exists for securing datagram based applications. In this paper we present DTLS, a datagram capable version of TLS. DTLS is extremely similar to TLS and therefore allows reuse of pre-existing protocol infrastructure. Our experimental results show that DTLS adds minimal overhead to a previously non-DTLS capable application.
---
paper_title: Security issues in SIP signaling in wireless networks and services

paper_content:

SIP appears to be a powerful and useful signaling protocol supporting mobility for wireless IP networks but it has inherent weaknesses and dangers. This paper is a study on the security and disruption time (delay) of SIP and SIP signaling in wireless networks and services. For disruption time, we specifically looked at the VoIP time. We compared the disruption time for MIP and SIP.
---
paper_title: Fuzzing for vulnerabilities in the VoIP space

paper_content:

Voice over IP is emerging as the key technology in the current and future Internet. This paper shares some essential practical experience gathered over a two years period in searching for vulnerabilities in the VoIP space. We will show a terrifying landscape of the most dangerous vulnerabilities capable to lead to a complete compromise of an internal network. All of the described vulnerabilities have been disclosed responsibly by our group and were discovered using our in-house developed fuzzing software KIF. The paper provides also mitigation techniques for all described vulnerabilities.
---
paper_title: Voice over IPsec: analysis and solutions

paper_content:

In this paper we present the results of the experimental analysis of the transmission of voice over secure communication links implementing IPsec. Critical parameters characterizing the real-time transmission of voice over an IPsec-ured Internet connection, as well as techniques that could be adopted to overcome some of the limitations of VoIPsec (Voice over IPsec), are presented Our results show that the effective bandwidth can be reduced up to 50% with respect to VoIP in case of VoIPsec. Furthermore, we show that the cryptographic engine may hurt the performance of voice traffic because of the impossibility to schedule the access to it in order to prioritize traffic. We present an efficient solution for packet header compression, which we call cIPsec, for VoIPsec traffic. Simulation results show that the proposed compression scheme significantly reduces the overhead of packet headers, thus increasing the effective bandwidth used by the transmission. In particular, when cIPsec is adopted, the average packet size is only 2% bigger than in the plain case (VoIP), which makes VoIPsec and VoIP equivalent from the bandwidth usage point of view.
---
paper_title: VoIP security assessment: methods and tools

paper_content:

VoIP networks are cost efficient solutions for providing voice services and value added voice based services to both public and enterprise level users. The security of VoIP network is of major importance, since malicious usage can lead to major security incidents and associated costs. In this paper we present a security management framework for VoIP. This framework is capable to perform advanced security assessment tasks for such a network. This paper describe our developed tool, highlights some of its key components and presents some of the learned experience while implementing the framework on a internal testbed.
---
paper_title: SIP Security Issue:SIP Authentication Procedure and Its Processing Load

paper_content:

The paper describes the security model used by SIP,the architecture of a possible commercial IP telephony service including user authentication,and the performance issue.
---
paper_title: A comparative analysis of the security aspects of the multimedia key exchange protocols

paper_content:

An IP-based multimedia communication system can be roughly divided into two planes: a signaling plane and a media plane. The signaling plane provides the necessary functions for setting up, controlling and terminating the multimedia sessions. The media plane provides the support for transporting the media content (audio, video, text or applications). Security mechanisms in the signaling planes address aspects related to user authentication, authorization or annonymization as well as the protection of the signaling messages against eavesdropping, interception and manipulation. The security aspects relevant to the media plane concern the encrypting of the media traffic as well as the efficient and secure exchange of the necessary keying material. This paper provides a comparative analysis of the security aspects of the most representative key exchange protocols designed for VoIP communication, namely DTLS, ZRTP, MIKEY and SDES. In this context, the key exchange protocols are described in relation to various authentication mechanisms and signaling plane security. Further, a number of possible attacks against these protocols are investigated and, where applicable, mitigation measures are proposed.
---
paper_title: Quality effects of wireless VoIP using security solutions

paper_content:

The challenge for wireless voice-over-IP (VoIP) is to achieve both voice quality and efficient use of spectrum. VoIP over wireless network (VoWLAN) has higher security vulnerabilities. Secured wireless VoIP presents many challenges to providing quality voice communication. This paper presents the results of an experimental analysis of the transmission of voice over a secure communication wireless network implementing various security solutions. The experimental results demonstrate how choices in voice-packet security and IP security influence the overall design decisions. This study raised an awareness of the effects of the various security solutions on voice qualities that must be considered when deploying VoIP in the wireless networks.
---
paper_title: A Comprehensive Secure VoIP Solution

paper_content:

VoIP represents the future of digital voice communications and many carriers are preparing for the VoIP revolution. However, a number of outstanding issues need to be settled. The most important are security, compression, packet size optimization, quality of service and performance in heterogeneous networks. We have addressed all of these issues [2, 3, 4, 5] and here we summarize our key findings in each of these areas.
---
paper_title: KiF: a stateful SIP fuzzer

paper_content:

With the recent evolution in the VoIP market, where more and more devices and services are being pushed on a very promising market, assuring their security becomes crucial. Among the most dangerous threats to VoIP, failures and bugs in the software implementation will still rank high on the list of vulnerabilities. In this paper we address the issue of detecting such vulnerabilities using a stateful fuzzer. We describe an automated attack approach capable to self-improve and to track the state context of a target device. We implemented our approach and were able to discover vulnerabilities in market leading and well known equipments and software.
---
paper_title: Internet Key Exchange (IKEv2) Protocol

paper_content:

This document describes version 2 of the Internet Key Exchange (IKE) ::: protocol. IKE is a component of IPsec used for performing mutual ::: authentication and establishing and maintaining security associations ::: (SAs). This version of the IKE specification combines the contents of ::: what were previously separate documents, including Internet Security ::: Association and Key Management Protocol (ISAKMP, RFC 2408), IKE (RFC ::: 2409), the Internet Domain of Interpretation (DOI, RFC 2407), Network ::: Address Translation (NAT) Traversal, Legacy authentication, and remote ::: address acquisition. Version 2 of IKE does not interoperate with ::: version 1, but it has enough of the header format in common that both ::: versions can unambiguously run over the same UDP port. [STANDARDS- ::: TRACK]
---
paper_title: Secure VoIP: call establishment and media protection

paper_content:

In this paper we study the possibility of establishing a secure VoIP telephone call using SIP. Different security services relevant for VoIP are presented and we argue that end-to-end authenticatio ...
---
paper_title: Vulnerabilities in SOHO VoIP gateways

paper_content:

The technological advancements and equipment cost reductions, aid in the rapid evolution of residential networks, which evolved in to an autonomous ecosystem with more elaborate services and capabilities than previously experienced. The elements in the residential networks are using a combination of hardware, software and communication protocols with inherent security vulnerabilities due to this new configuration. One such component is the voice over IP (VoIP) gateway, which in many cases is replacing the current Internet gateway thus providing network as well as VoIP connectivity. The new VoIP gateways are required to provide greater robustness and security than the current Internet gateways since they need to support critical services such as E911 and real-time multimedia applications. This paper reflects the results of a research study that aimed at identifying security issues associated with residential VoIP gateways, including signaling and media routing, implementation, operation, and network management in order to understand their impact on end users and service providers. The findings suggest that attacks such as message, replay, amplification (i.e. Denial of Service or "DoS" ), annoyance (SPIT), and eavesdropping along with misconfiguration and several other weaknesses can have a severe impact on the subscriber's ability to communicate in an emergency or disclosure of sensitive information.
---
paper_title: A New Authentication Scheme for Session Initiation Protocol

paper_content:

In 2008, Tsai proposed an efficient nonce-based authentication scheme for Session Initiation Protocol (SIP). The current paper, however,demonstrates that Tsai's authentication scheme is still vulnerable to off-line password guessing attacks, Denning-Sacco attack and stolen-verifier attacks, and does not provide perfect forward secrecy. We also propose a new secure and efficient authentication scheme based on the elliptic curve discrete logarithm problem (ECDLP) for SIP in order to overcome such security problems.
---
paper_title: Securing VoIP and PSTN from integrated signaling network vulnerabilities

paper_content:

The liberalization of public switched telephone network (PSTN) and growing acceptance of SIGTRAN protocol suite have introduced new and yet to be trusted signaling entities. Thus security threats emerging from one network not only affects itself but other network also. We show how this integrated signaling environment can become a security threat to emerging VoIP and PSTN networks. We propose a security solution as a fix. Our proposal goes beyond "Gateway Screening" and "SS7 Gatekeeper" proposed by Telcordia and Verizon respectively to defend vulnerable SS7 network.
---
paper_title: Providing response identity and authentication in IP telephony

paper_content:

The traditional circuit switched infrastructure for telephony services are being replaced by voice over IP (VoIP) for many forthcoming benefits. At the same time, there are some new security issues due to the introduction of new packet switched infrastructure and new VoIP protocols. One of crucial security issues faced by the current VoIP protocols is about the end-to-end user identity and how to authenticate it. This is especially important for guaranteeing integrity and privacy of the response information, because the current proposal solutions fail in many real-world scenarios. In this study, we demonstrate one new mechanism for providing and authenticating response identify, based on Session Initiation Protocol (SIP). In order to prevent several kinds of malicious attacks through response and protect the integrity of response message, another new per-hop authentication mechanism was proposed to handle SIP response. With the combination of these proposed mechanisms, response identity can be securely provided, and spam IP telephony (SPIT) or other malicious attacks can be identified and prevented from attacking the VoIP service.
---
paper_title: STEM: Secure Telephony Enabled Middlebox

paper_content:

Dynamic applications, including IP telephony, have not seen wide acceptance within enterprises because of problems caused by the existing network infrastructure. Static elements, including firewalls and network address translation devices, are not capable of allowing dynamic applications to operate properly. The Secure Telephony Enabled Middlebox (STEM) architecture is an enhancement of the existing network design to remove the issues surrounding static devices. The architecture incorporates an improved firewall that can interpret and utilize information in the application layer of packets to ensure proper functionality. In addition to allowing dynamic applications to function normally, the STEM architecture also incorporates several detection and response mechanisms for well-known network-based vulnerabilities. This article describes the key components of the architecture with respect to the SIP protocol.
---
paper_title: Secure Session Management Mechanism in VoIP Service

paper_content:

VoIP (Voice-over-IP) technology has come of age and is quickly gaining momentum on Broadband networks. VoIP packetizes phone calls through the same routes used by network and Internet traffic and is consequently prone to the same cyber threats that plague data networks today. These include denial-of service attacks, worms, viruses, and hacker exploitation. In addition to these traditional network security and availability concerns, there are also a plethora of new VoIP protocols that have yet to undergo detailed security analysis and scrutiny. The new challenges of VoIP security are session hijacking, abnormal termination, call flooding and spam. History has shown that many other advances and trends in information technology typically outpace the corresponding realistic security requirements that are often tackled only after these technologies have been widely adopted and deployed. In this paper, we describe the technology protects networks against the known VoIP threats, and propose security mechanism for VoIP session management.
---
paper_title: Carrier VoIP Security Architecture

paper_content:

This document describes a Security Architecture for Real-time Services over IP (RSoIP) Architecture. The architecture described here is used to protect AT&T's VoIP infrastructure, hence our liberal use of AT&T VoIP architecture in describing the proposed security architecture. Our VoIP Security architecture describes guidelines and mechanisms designed to safeguard customer data, our VoIP network infrastructure, and voice and multimedia services and applications against internal and external threats including Denial-of-Service (DoS) and Distributed DoS (DDoS) attacks. Our VoIP Security architecture is designed to ensure availability, confidentiality, privacy, and integrity of user information.
---
paper_title: Increasing SIP firewall performance by ruleset size limitation

paper_content:

To protect SIP communication networks from attacks, especially flooding attacks like denial-of-service or message spam, intrusion detection systems (IDS) are deployed at the ingress point of the network to filter potential malicious traffic. A key issue of IDS performance is the operation of its firewall to block malicious user requests. Depending on the complexity of the firewall ruleset, filtering performance of the IDS can decrease considerably during high-load flooding situations. In this paper we propose a scheme to increase IDS firewall performance by merging several similar rules into more general ones and ignoring lesser relevant rules to limit the number of firewall rules. We formalise a mathematical model to compute new firewall rules and show exemplary with traffic from SIP VoIP communication networks how the calculation can be performed. If applied to a VoIP IDS, the scheme can increase firewall thoughput considerably, while retaining most of its effectiveness.
---
paper_title: SIP intrusion detection and prevention: recommendations and prototype implementation

paper_content:

As VoIP deployment are expected to grow, intrusion problems similar to those of which data networks experience will become very critical. In the early stages of deployment, the intrusion and security problems have not been seriously considered, although they could have a negative impact on VoIP deployment. In the paper, SIP intrusion detection and prevention requirements are analyzed and an IDS/IPS architecture is proposed. A prototype of the proposed architecture was implemented using as a basis the very popular open-source software Snort, a network-based intrusion detection and prevention system. The prototype of the proposed architecture extends the basic functionality of Snort, making use of the preprocessing feature that permits analyzing protocols of layers above the TCP/UDP one. The preprocessors block is a very powerful one since it permits to implement both knowledge and behavior based intrusion detection and prevention techniques in Snort that basically adopts a network based technique. An important requirement of an IPS is that legitimate traffic should be forwarded to the recipient with no apparent disruption or delay of service. Hence, the performance of the proposed architecture has been evaluated in terms of impact that its operation has on the QoS experienced by the VoIP users.
---
paper_title: Middleboxes: Controllable media firewalls

paper_content:

Internet technology is promised for the broadband multi-service future. However, it is unclear how this technology can bring service providers the needed revenue, since today this technology cannot provide basic quality guarantees for the services rendered. Generally, over-provisioning of the bandwidth is used to get the services to an acceptable level, but this is costly and cannot work in areas where high aggregation rates are necessary (such as the local loop). Today IP (router) technology lacks mechanisms for high-granularity access control, per-user accounting, and quality of service (QoS) policing. We believe that, for a service provider to deploy billable services, these issues need to be resolved. Only if access to the service is controlled and only when the network provides information about the usage of the network elements can next-generation services in the telecommunication industry, like voice over IP (VoIP) and multimedia conferencing, be rolled out profitably. In this paper, we present a technology that can address these needs. We employ controllable firewalls that have the ability to prevent unwanted IP traffic from entering a network. Creating pinholes that allow individual calls (voice or real-time multimedia streams) in controllable firewalls can be done very fast and efficiently. Traditional firewalls have no such provisioning. Multiple application servers should be able to request pinholes to one or more controllable firewalls. This approach, while familiar from the public switched telephone network (PSTN), is a new paradigm for IP networks.
---
paper_title: Evaluating and improving firewalls for IP-telephony environments

paper_content:

Firewalls are a well established security mechanism for providing access control and auditing at the borders between different administrative network domains. Their basic architecture, techniques and operation modes did not change fundamentally during the last years. On the other side new challenges emerge rapidly when new innovative application domains have to be supported. IP-Telephony applications are considered to have a huge economic potential in the near future. For their widespread acceptance and thereby their economic success they must cope with established security policies. Existing firewalls face immense problems here, if they - as it still happens quite often - try to handle the new challenges in a way they did with "traditional applications". As we will show in this paper, IP-Telephony applications differ from those in many aspects, which makes such an approach quite inadequate. After identifying and characterizing the problems we therefore describe and evaluate a more appropriate approach. The feasibility of our architecture will be shown. It forms the basis of a prototype implementation, that we are currently working on.
---
paper_title: VoIP Honeypot Architecture

paper_content:

Voice over IP (VoIP) or telephony services over Internet announces a new revolution in the telecommunication world tor its management simplicity and cost reduction. VoIP security extends the existent risk range of IP protocols and infrastructures and introduces new attacks as well. Threats identification and standardization, secure signaling and media architectures, as well as intrusion detection and prevention mechanisms are currently under debate in the research community. We propose in this article a SIP (Session Initiation Protocol) specific honeypot We describe its design and implementation. We detail the inference mechanism which classifies the received messages. We show how the model investigates about a received call and raises an appropriate conclusion.
---
paper_title: On Security of An Efficient Nonce-based Authentication Scheme for SIP

paper_content:

Recently, Tsai proposed an efficient nonce-based authentication scheme for session initiation protocol (T-SIP for short). However, the author shall show that T-SIP is vulnerable to perfect forward secrecy, password guessing attacks, and insider attacks.
---
paper_title: Towards a security policy for VoIP applications

paper_content:

Recently voice over internet protocol (VoIP) technology is attracting more and more attention and interest in the industry. VoIP applications such as IP telephony systems involve sending voice transmissions as data packets over private or public IP networks as well as reassembled and decoded on the receiving side. Security concerns are always the major barrier that prevents many businesses from employing VoIP technologies. The IP telephony security is challenging as it involves many disciplines, from encryption to access control policies. In general, the engineering of a security policy starts with risk analysis and ends with a set of security assertions that is ready for integration into the security policy framework. In this paper, we discuss a security policy from the perspectives of communication and application security properties such as confidentiality, integrity and availability for constructing a security framework for VoIP applications
---
paper_title: Authentication of Signaling in VoIP Applications

paper_content:

Session initiation protocol known as SIP is currently being preferred to H.323 protocol due to its simple architecture. In traditional SIP, security mechanisms are inadequate for assuring the identity of the end user based on cryptography. This is vulnerable in the sense that a third person, an impersonator, may easily duplicate one of the users engaged in the session. This can pose serious threats as it affects the secrecy of the user. In order to reduce the threat posed by an eavesdropper, an authentication scheme is required. This paper proposes a scheme for authenticating the end users identities with the outbound proxy server in that domain with the help of the registrar server. The authentication scheme is based on end users public key infrastructure (PKI) certificate and strong one way hash function. The proposed scheme is implemented using JAVA and tested for its validity in a LAN environment. The delay overhead in providing authentication in the proposed scheme is found to be within the allowable limit as per IETF standard
---
paper_title: Issues and challenges in securing VoIP

paper_content:

Voice over the Internet protocol (VoIP) is being rapidly deployed, and the convergence of the voice and data worlds is introducing exciting opportunities. Lower cost and greater flexibility are the key factors luring enterprises to transition to VoIP. Some security problems may surface with the widespread deployment of VoIP. In this article, we discuss these security problems and propose a high-level security architecture that captures required features at each boundary-network-element in the VoIP infrastructure. We describe mechanisms to efficiently integrate information between distributed security components in the architecture.
---
paper_title: A New authentication Mechanism and Key Agreement Protocol for SIP Using Identity-based Cryptography

paper_content:

The Session Initiation Protocol (SIP) protocol is commonly used to establish Voice over IP (VoIP) calls. IETF SIP standards do not specify a secure authentication process thus allowing malicious parties to impersonate other parties or to charge calls to other parties. This paper proposes an extension to the SIP protocol that uses an identity-based authentication mechanism and key agreement protocol. These extensions provide stronger cryptographic assurances for VoIP authentication and enable provably secure key agreement between users. The use of ID based cryptography means that a large Public Key Infrastructure (PKI) is not required thus making this protocol viable for large scale implementation.
---
paper_title: Intrusion detection in voice over IP environments

paper_content:

In this article, we present the design of an intrusion detection system for voice over IP (VoIP) networks. The first part of our work consists of a simple single- component intrusion detection system called Scidive. In the second part, we extend the design of Scidive and build a distributed and correlation-based intrusion detection system called Space Dive. We create several attack scenarios and evaluate the accuracy and efficiency of the system in the face of these attacks. To the best of our knowledge, this is the first comprehensive look at the problem of intrusion detection in VoIP systems. It includes treatment of the challenges faced due to the distributed nature of the system, the nature of the VoIP traffic, and the specific kinds of attacks at such systems.
---
paper_title: An ontology description for SIP security flaws

paper_content:

Voice over IP (VoIP) services based on the Session Initiation Protocol (SIP) gain ground as compared to other protocols like MGCP or H.323. However, the open SIP architecture constitutes the provided services vulnerable to various attacks, similar to those currently existing in Internet. The lack of a formal way to describe VoIP vulnerabilities hinders the development of tools that could be utilized for identifying such vulnerabilities or for testing the security level of the offered services, in both cases the tools being independent from a specific implementation. This paper introduces such a formalization for SIP-based VoIP services, utilizing ontologies, facilitating an extensible description of known SIP security vulnerabilities that can be employed in a real environment for testing or intrusion detection purposes.
---
paper_title: Holistic VoIP intrusion detection and prevention system

paper_content:

VoIP security is crucial for current and future networks and services. The rapid shift from a closed and confined telephony towards an all IP network supporting end to end VoIP services provides major challenges to the security plane. Faced with multiple attack vectors, new and comprehensive defensive security solutions for VoIP must emerge from the research community. This paper describes a multilayer intrusion detection and prevention system architecture for VoIP infrastructures. The key components of the approach are based on a VoIP-specific honeypot and on an application layer event correlation engine. While each component alone can detect only a subset of VoIP-specific attacks, the two of them together can provide an effective defense for the many class of attacks. We show in this paper, how different and complementary conceptual approaches can jointly provide an in depth defense for VoIP architectures.
---
paper_title: A Self-learning System for Detection of Anomalous SIP Messages

paper_content:

Current Voice-over-IP infrastructures lack defenses against unexpected network threats, such as zero-day exploits and computer worms. The possibility of such threats originates from the ongoing convergence of telecommunication and IP network infrastructures. As a countermeasure, we propose a self-learning system for detection of unknown and novel attacks in the Session Initiation Protocol (SIP). The system identifies anomalous content by embedding SIP messages to a feature space and determining deviation from a model of normality. The system adapts to network changes by automatically retraining itself while being hardened against targeted manipulations. Experiments conducted with realistic SIP traffic demonstrate the high detection performance of the proposed system at low false-positive rates.
---
paper_title: Secure authentication scheme for session initiation protocol

paper_content:

The Session Initiation Protocol provides an expandable and easy solution to the IP-based telephony environment. When users ask to use an SIP service, they need to be authenticated in order to get service from the server. Therefore, some SIP authentication procedure schemes were proposed to meet the above demand. However, there are security problems that need to be solved, such as off-line password guessing attacks and server spoofing. In this article, we shall propose a new scheme for a secure authentication procedure for the Session Initiation Protocol to enhance the security of the original scheme.
---
paper_title: Security design and evaluation in a VoIP secure infrastracture: a policy based approach

paper_content:

This paper aims at defining security levels of a voice over IP infrastructure during its design phase. The proposed technique uses security policies to express the security statements that could be adopted, and the policy evaluation is based on security metrics to compare policies. The technique first step consists of policy structure definition; the proposed approach is applied on the target VoIP infrastructure. In the second step of the technique, the policy is used to define reference levels against which a security designer can evaluate his design choice or compare the adopted security solution with existing ones.
---
paper_title: A Robust and Efficient SIP Authentication Scheme

paper_content:

Apart from its security, an SIP (Session Initiation Protocol) authentication protocol shall be efficient; because in order to replace traditional telephony, VoIP services have to offer enough security and QoS compared to PSTN services. Recently, Srinivasan et al. proposed an efficient SIP authentication scheme. The low delay overhead introduced by their scheme, causes the total call setup time to be well within the acceptable limit recommended by ITU-T. Based on their work, this paper proposes an SIP authentication scheme. In both schemes, the end users are authenticated with the proxy server in their domain using the registrar server. Comparing with the Srinivasan et al.’s scheme, our proposed scheme is more efficient and secure. Our scheme’s low overhead makes it suitable for applying as an authentication protocol in SIP networks.
---
paper_title: Casting out Demons: Sanitizing Training Data for Anomaly Sensors

paper_content:

The efficacy of anomaly detection (AD) sensors depends heavily on the quality of the data used to train them. Artificial or contrived training data may not provide a realistic view of the deployment environment. Most realistic data sets are dirty; that is, they contain a number of attacks or anomalous events. The size of these high-quality training data sets makes manual removal or labeling of attack data infeasible. As a result, sensors trained on this data can miss attacks and their variations. We propose extending the training phase of AD sensors (in a manner agnostic to the underlying AD algorithm) to include a sanitization phase. This phase generates multiple models conditioned on small slices of the training data. We use these "micro- models" to produce provisional labels for each training input, and we combine the micro-models in a voting scheme to determine which parts of the training data may represent attacks. Our results suggest that this phase automatically and significantly improves the quality of unlabeled training data by making it as "attack-free" and "regular" as possible in the absence of absolute ground truth. We also show how a collaborative approach that combines models from different networks or domains can further refine the sanitization process to thwart targeted training or mimicry attacks against a single site.
---
paper_title: Certificateless Public Key Cryptography

paper_content:

This paper introduces and makes concrete the concept of certificateless public key cryptography (CL-PKC), a model for the use of public key cryptography which avoids the inherent escrow of identity-based cryptography and yet which does not require certificates to guarantee the authenticity of public keys. The lack of certificates and the presence of an adversary who has access to a master key necessitates the careful development of a new security model. We focus on certificateless public key encryption (CL-PKE), showing that a concrete pairing-based CL-PKE scheme is secure provided that an underlying problem closely related to the Bilinear Diffie-Hellman Problem is hard.
---
paper_title: A POLICY-BASED DESIGN METHODOLOGY AND PERFORMANCE EVALUATION FRAMEWORK FOR A SECURE VOIP INFRASTRUCTURE

paper_content:

The increasing interest in telecommunication systems and the wide spreading of computer networks within commercial and scientific field, are going in the direction of a deep integration of phone and data systems into a single network infrastructure. We are particular interested in security issues that arise in such context, thinking, for example, about authentication and billing problems. The available security mechanisms can offer different guarantees but their introduction greatly affect the whole system performances. To guarantee system usability and an efficient resource usage, we propose a design methodology and a framework to evaluate how each security choice affects the whole system performances and help system designers in evaluating the performance-security trade-off.
---
paper_title: Protecting IP Multimedia Subsystem (IMS) Service Delivery Platform from Time Independent Attacks

paper_content:

With the emergence of mobile multimedia services, such as unified messaging, click to dial, cross network multiparty conferencing and seamless multimedia streaming services, the fixed-mobile convergence and voice-data integration has started, leading to an overall Internet-Telecommunications merger. The IP multimedia subsystem (IMS) is considered as the next generation service delivery platform in this converge communication world. It consists of modular design with open interfaces and enables the flexibility for providing multimedia services over IP technology. At parallel this open based emerging technology has security challenges from multiple communication platforms like IP, SIP and RTP. In this article our objective is to develop security model to protect IMS service delivery platform (SDP) from different time independent attacks e.g. SQL injection and media flow attacks. These attacks ultimately downfall the value added services. At the end we shall present the performance results at Fokus Fraunhofer Testbed to see the proposed solution for real world applications.
---
paper_title: Proxy-based Security for the Session Initiation Protocol (SIP)

paper_content:

There is a trend towards voice-over-IP systems based on the session initiation protocol (SIP), which is a protocol for session management in general. However, as signalling data is transferred using the Internet, systems face security problems. Thus, at least authentication of the participants and confidentiality of signalling data have to be ensured as basic mechanism. In this work, we propose a mechanism for assuring the identity of a group of users fulfilling the same role (e.g., employees of a customer call centre). Using our concept enables using only one certificate for the whole group for signing and encrypting messages according to the SIP standard. Our mechanism works transparently for users as we provide a special proxy server for this purpose, which significantly reduces administration efforts and resource needs on the participating nodes. Furthermore, such a proxy server can be used for transparently validating and decrypting SIP messages as well. This reduces efforts on the terminals, resulting in an improved resource-usage, e.g., on a personal digital assistant. We provide an implementation of the concept based on the NIST SIP proxy server.
---
paper_title: Cryptographically Transparent Session Initiation Protocol (SIP) Proxies

paper_content:

Proxies provide important rendezvous service in the session initiation protocol (SIP), but it comes at a cost to privacy. A SIP proxy is privy to all of the signaling exchanged between two user agents, even if that signaling is performed over a secure channel (e.g., a Transport Layer Security channel.) This paper proposes and evaluates a mechanism that allows the proxies to create an overlay network between the user agents for rendezvous, and once that is done, the proxies become transparent traffic forwarders. From then onwards, user agents can authenticate each other directly and exchange cryptographically secure signaling traffic over the overlay network created by the proxies. This mechanism is applicable to traditional client/server SIP as well as Peer-to-Peer SIP.
---
paper_title: SCIDIVE: a stateful and cross protocol intrusion detection architecture for voice-over-IP environments

paper_content:

Voice-over-IP (VoIP) systems are gaining in popularity as the technology for transmitting voice traffic over IP networks. As the popularity of VoIP systems increases, they are being subjected to different kinds of intrusions some of which are specific to such systems and some of which follow a general pattern. VoIP systems pose several new challenges to intrusion detection system (IDS) designers. First, these systems employ multiple protocols for call management (e.g., SIP) and data delivery (e.g., RTP). Second, the systems are distributed in nature and employ distributed clients, servers and proxies. Third, the attacks to such systems span a large class, from denial of service to billing fraud attacks. Finally, the systems are heterogeneous and typically under several different administrative domains. In this paper, we propose the design of an intrusion detection system targeted to VoIP systems, called SCIDIVE (pronounced "Skydive"). SCIDIVE is structured to detect different classes of intrusions, including, masquerading, denial of service, and media stream-based attacks. It can operate with both classes of protocols that compose VoIP systems - call management protocols (CMP), e.g., SIP, and media delivery protocols (MDP), e.g., RTP. SCIDIVE proposes two abstractions for VoIP IDS - stateful detection and cross-protocol detection. Stateful detection denotes assembling state from multiple packets and using the aggregated state in the rule-matching engine. Cross protocol detection denotes matching rules that span multiple protocols. SCIDIVE is demonstrated on a sample VoIP system that comprises SIP clients and SIP proxy servers with RTP as the data delivery protocol. Four attack scenarios are created and the accuracy and the efficiency of the system evaluated with rules meant to catch these attacks.
---
paper_title: VoIP Intrusion Detection Through Interacting Protocol State Machines

paper_content:

Being a fast-growing Internet application, voice over Internet protocol (VoIP) shares the network resources with the regular Internet traffic, and is susceptible to the existing security holes of the Internet. Moreover, given that voice communication is time sensitive and uses a suite of interacting protocols, VoIP exposes new forms of vulnerabilities to malicious attacks. In this paper, we propose a highly-needed VoIP intrusion detection system. Our approach is novel in that, it utilizes not only the state machines of network protocols but also the interaction among them for intrusion detection. This detection approach is particularly suited for protecting VoIP applications, in which a melange of protocols are involved to provide IP telephony services. Based on tracking deviations from interacting protocol state machines, our solution shows promising detection characteristics and low runtime impact on the perceived quality of voice streams
---
paper_title: Efficient Nonce-based Authentication Scheme for Session Initiation Protocol

paper_content:

In recent years, Session Initiation Protocol (SIP) is more and more popular. However, there are many security problems in the Session Initiation Protocol. In 2005, Yang et al. [9] proposed a secure authentication scheme for Session Initiation Protocol. This authentication scheme is based on Diffe-Hellman [2] concept, so the computation cost of this authentication scheme is very high. In order to improve this shortcoming, Durlanik et al. [3] also proposed an authentication Scheme using ECDH in 2005. However, the computation cost of this authentication scheme is still very high. In this paper, we propose an efficient nonce-based authentication scheme. The computation cost of this authentication scheme is lower than Yang et al. s authentication scheme and Durlanik et al.s authentication scheme, and it is very suitable for low computation power equipment.
---
paper_title: Intrusion detection system for signal based SIP attacks through timed HCPN

paper_content:

As session initiation protocol is becoming widely used for the current IP telephony services due to its simplicity and powerful functions, vulnerabilities it exposes make it susceptible to various attacks especially signal based SIP-specific attacks. Based on the security issues of SIP, in this paper, we propose the design of an intrusion detection system combined with misuse and anomaly detection for these threats by a feedback mechanism. A timed HCPN model is utilized and suited to drive and simulate the IDS for SIP with four machines. Also some detection solutions for specific attacks are provided like two recall methods for CANCEL attack and so on
---
paper_title: Detecting more SIP attacks on VoIP services by combining rule matching and state transition models

paper_content:

The Session Initiation Protocol (SIP) has been used widely for Voice over IP (VoIP) service because of its potential advantages, economical efficiency and call setup simplicity. However, SIP-based VoIP service basically has two main security issues, malformed SIP message attack and SIP flooding attack. In this paper, we propose a novel mechanism for SIP-based VoIP system utilizing rule matching algorithm and state transition models. It detects not only two main attacks, but also covers more SIP attacks. Instead of simply combining rule comparison and counting number of SIP messages, we develop secure RFC 3261 rules based on existing RFC 3261 rules, so that proposed mechanism shows 26% higher detection rate for malformed attack. Moreover, we utilize session information and define the features of each state in order to detect abnormal situations including SIP flooding. As the result, it is shown that the proposed mechanism provides not only higher accuracy, but also covering more SIP attacks including two main attacks.
---
paper_title: On the inefficacy of Euclidean classifiers for detecting self-similar Session Initiation Protocol (SIP) messages

paper_content:

The Session Initiation Protocol (SIP) is an important multimedia session establishment protocol used on the Internet. Due to the nature and deployment realities of the protocol (ASCII message representation, most deployments over UDP, limited use of message encryption), it becomes relatively easy to attack the protocol at the message level. To mitigate this, self-learning systems have been proposed to counteract new threats. However the efficacy of existing machine learning algorithms must be studied on varied data sets before they can be successfully used. Existing literature indicates that Euclidean distance based classifiers work well to detect anomalous messages. Our work suggests that such classifiers do not produce adequate results for well-crafted malicious messages that differ very slightly from normal messages. To demonstrate this, we gather SIP traffic and minimally perturb it using 13 generic transforms to create malicious SIP messages. We use the Levenshtein distance, L, as a measure of similarity between normal and malicious SIP messages. We subject our dataset — consisting of malicious and normal SIP messages — to Euclidean distance-based classifiers as well as four standard classifiers. Our results show vast differences for Euclidean distance-based classifiers on our dataset than reported in current literature. We further see that the standard classifiers are better able to classify an anomalous message when L is small.
---
paper_title: Towards a Forensic Analysis for Multimedia Communication Services

paper_content:

No matter how robust the employed security mechanisms are malicious users or attackers will always find a way to bypass them. In addition, National Institute of Security and Technology mentions "In conjunction with appropriate tools & procedures, audit trail can assist in detecting security violation and flaws in applications". Until now, in Multimedia Communication Services (MCS), such as Voice over IP, audit trails are not utilized in security audits due to (a) the lack of the appropriate analysis tools and (b) privacy restrictions. In this paper we report on the analysis of MCS audit trail by employing a novel method for identifying "uncommon" traffic indicating non normal behaviour that does not violate users’ privacy. We rely on entropy theory and the notion of "itself information" to quantify the randomness of specific message segments, and we also introduce the term "actual itself information" for the assessment of entire message randomness. To protect users’ privacy we hash audit trail’s data. For evaluating the applicability of our proposed method we utilize an audit trail of a real MCS provider published by honey pot project. Initial outcomes show the feasibility of employing such a method to recognize "uncommon" traffic, recorded in MCS audit trail.
---
paper_title: A framework for detecting malformed messages in SIP networks

paper_content:

Internet telephony like any other Internet service suffers from security flaws caused by various implementation errors (e.g. in end-users terminals, protocols, operating systems, hardware, etc). These implementation problems usually lead VoIP subsystems (e.g. SIP servers) to various unstable operations whenever trying to process a message not conforming to the underlying standards. As Internet telephony becomes more and more popular, attackers will attempt to exhaustively "test" implementations' robustness, transmitting various types of malformed messages to them. Since it is almost infeasible to avoid or predict every potential error caused during the developing process of these subsystems, it is necessary to specify an appropriate and robust, from the security point of view, framework that will facilitate the successful detection and handling of any kind of malformed messages aiming to destruct the provided service. In this paper, we adequately present malformed message attacks against SIP network servers and/or SIP end-user terminals and we propose a new detection "framework" of prototyped attacks' signatures that can assist the detection procedure and provide effective defence against this category of attacks
---
paper_title: A framework for protecting a SIP-based infrastructure against malformed message attacks

paper_content:

This paper presents a framework that can be utilized for the protection of session initiation protocol (SIP)-based infrastructures from malformed message attacks. Its main characteristic is that it is lightweight and that it can be easily adapted to heterogeneous SIP implementations. The paper analyzes several real-life attacks on VoIP services and proposes a novel detection and protection mechanism that is validated through an experimental test-bed under different test scenarios. Furthermore, it is demonstrated that the employment of such a mechanism for the detection of malformed messages imposes negligible overheads in terms of the overall SIP system performance.
---
paper_title: Load Characterization and Anomaly Detection for Voice Over IP Traffic

paper_content:

We consider the problem of traffic anomaly detection in IP networks. Traffic anomalies typically arise when there is focused overload or when a network element fails and it is desired to infer these purely from the measured traffic. We derive new general formulae for the variance of the cumulative traffic over a fixed time interval and show how the derived analytical expression simplifies for the case of voice over IP traffic, the focus of this paper. To detect load anomalies, we show it is sufficient to consider cumulative traffic over relatively long intervals such as 5 min. We also propose simple anomaly detection tests including detection of over/underload. This approach substantially extends the current practice in IP network management where only the first-order statistics and fixed thresholds are used to identify abnormal behavior. We conclude with the application of the scheme to field data from an operational network.
---
paper_title: VoIP Intrusion Detection Through Interacting Protocol State Machines

paper_content:

Being a fast-growing Internet application, voice over Internet protocol (VoIP) shares the network resources with the regular Internet traffic, and is susceptible to the existing security holes of the Internet. Moreover, given that voice communication is time sensitive and uses a suite of interacting protocols, VoIP exposes new forms of vulnerabilities to malicious attacks. In this paper, we propose a highly-needed VoIP intrusion detection system. Our approach is novel in that, it utilizes not only the state machines of network protocols but also the interaction among them for intrusion detection. This detection approach is particularly suited for protecting VoIP applications, in which a melange of protocols are involved to provide IP telephony services. Based on tracking deviations from interacting protocol state machines, our solution shows promising detection characteristics and low runtime impact on the perceived quality of voice streams
---
paper_title: Intrusion Detection Systems for IP Telephony Networks

paper_content:

Intrusion detection systems (IDS) provide security for network systems. They are used in computer networks to detect violations against security policies or unusual events that could lead towards a security thread. Telephone networks based on the internet protocol (IP) called IP telephony (IPT) are a recent development in network usage and will become a common application in the next years as they can provide integrated services based on telephony communications. We identify IPT security demands as well as risks and analyze the possibility of adding IDS concepts to IPT systems. Digital audio watermarking is a technology able to provide different security aspects in this context. The combination of classic IDS and audio watermarking leads to new and promising way of user and data authentication and monitoring of calls.
---
paper_title: Voice over IP: Risks, Threats and Vulnerabilities

paper_content:

Voice over IP (VoIP) and Internet Multimedia Subsystem (IMS) technologies are rapidly being adopted by consumers, enterprises, governments and militaries. These technologies offer higher flexibility and more features than traditional telephony (PSTN) infrastructures, as well as the potential for lower cost through equipment consolidation and, for the consumer market, new business models. However, VoIP/IMS systems also represent a higher complexity in terms of architecture, protocols and implementation, with a corresponding increase in the potential for misuse. Here, we begin to examine the current state of affairs on VoIP/IMS security through a survey of known/disclosed security vulnerabilities in bug-tracking databases. This paper should serve as a starting point for understanding the threats and risks in a rapidly evolving set of technologies that are seeing increasing deployment and use. Our goal is to gain a better understanding of the security landscape with respect to VoIP/IMS, toward directing future research in this and other similar emerging technologies.
---
paper_title: A Look at VoIP Vulnerabilities

paper_content:

Voice over IP (VOIP) and Internet Multimedia Subsystem (IMS) technologies offer higher flexibility than traditional telephony infrastructures and the potential for lower cost through equipment consolidation and new business models. In this article, I examined the current state of affairs on VOIP/IMS security through a survey of all the 221 kown/disclosed security vulnerabilities in the Common vulnerabilities and Exposure (CVE) database and in IETF RFCs/drafts. My key finding is than the higher complexity of VOIP/IMSsystems leads to a variety of attcks vectors, many of them caused by unforeseen and unexpected components interactions. A second finding is that what people seem to worry about in VOIP (traffic interception and impresionation) bears no resemblance to the distribution of vulnerabilities actually disclosed. The article concludes with some practical suggestions for securing VOIP systems.
---

Title: A Comprehensive Survey of Voice over IP Security Research

Section 1: INTRODUCTION
Description 1: Provide an introduction to Voice over IP (VoIP), its benefits, its popularity in various markets, and the security challenges it faces.

Section 2: SIP OVERVIEW
Description 2: Present an overview of the Session Initiation Protocol (SIP), its architecture, operation, and the security mechanisms associated with it.

Section 3: VOIP THREAT CLASSIFICATION
Description 3: Describe the VoIP security threat taxonomy as defined by the VoIP Security Alliance and explain the key elements of this classification.

Section 4: Collection Methodology
Description 4: Explain the methodologies used for collecting and classifying the VoIP security research papers surveyed in the study.

Section 5: VoIPSA-based Classification
Description 5: Discuss the papers that fit within the first four categories of the VoIPSA taxonomy and provide a breakdown of the research work in each of these areas.

Section 6: Additional Categories
Description 6: Classify and discuss the remainder of the surveyed work using the categories such as Overviews and Surveys, Field Studies and Analysis, Performance Analysis, Authentication Protocols, Architectures, Middleboxes, Intrusion Detection, and Miscellaneous.

Section 7: DISCUSSION
Description 7: Summarize the findings from the survey, highlight under-represented research areas, and discuss the implications for the VoIP security field.

Section 8: CONCLUSIONS
Description 8: Conclude the survey with a summary of the findings, gaps in existing research, and recommendations for future work.