Detecting authentication misuse attacks against SIP entities

Nowadays mainstream of evolution towards next generation networks extends SIP application as a simple and efficient protocol for management of multimedia communications. Simplicity of SIP increases security concerns for service providers about various kinds of misuse including Denial of Service (DoS) attacks. The target of DoS attacks in SIP can be bandwidth, memory or CPU. In this paper we proposed a user profile based anomaly detection method to identify CPU-based DOS attacks that misuse authentication mechanism of SIP. We validated and evaluated our proposed solution in real test-bed based on the well-known open-source tools. The simulation results report the effectiveness of our approach in detection of this specific type of attacks.