Defesas seletivas para mitigar ataques de negação de serviço às aplicações de VoIP

Abstract

Similar to others IP network based services, VoIP applications are quite vulnerable to dangerous distributed denial of service attacks (DDoS). Commonly, these attacks had been carried out by sending numerous requests to a SIP server (SIP flooding) in order to overload it. Although still harmful, such attacks can be easily identified by defenses that detect sudden changes in the network traffic volume. Most recent attacks, classified as Low-Rate, have bypassed such defense mechanisms attacking applications by generating traffic very similar to normal client traffic rendering such monitoring defenses ineffective. In a new form of DDoS attack called Telephony Denial of Service (TDoS), attacker has been using malicious calls to prevent legitimate clients to receive or to make calls. An example of a Low-Rate TDoS attack is the Coordinated Call Attack, where attackers simply make calls to each other to exhaust the target VoIP server’s resources. An efficient selective defense against Low-Rate attacks exploiting the HTTP protocol is the tool SeVen. This work demonstrates that selective strategies can also be successfully used to mitigate TDoS attacks, in particular, the Coordinated Call Attack. The contributions of this work are three-fold: (1) A selective strategy suitable for VoIP applications; (2) Formulating the defense in the Maude tool and conducting simulations using statistical model checker (PVeStA); (3) Experimental results show that without defense, less than 41% of users have access to the target VoIP service, whereas with the selective defense, availability is around 98%.