The Devil is in the Detail: SDP-Driven Malformed Message Attacks and Mitigation in SIP Ecosystems

VoIP services, in general, and session initiation protocol (SIP) ones, in particular, continue to grow at a fast pace and have already become a key component of next-generation networks. Despite this proliferation, SIP-based services expose a large attack surface for perpetrators, especially those who seek to cause denial of service (DoS). While so far, a plethora of works in the literature have been devoted to the detection of DoS attacks in SIP ecosystems, the focus is on those which exploit SIP headers neglecting the message body. In an effort to fill this gap, this paper concentrates on the detection of DoS attacks, which, instead, capitalize on the session description protocol (SDP) part of SIP requests. To this end, we not only scrutinize this ilk of attacks and demonstrate their effect against the end-user but also develop an open-source extensible SDP parser module capable of detecting intentionally or unintentionally crafted SDP segments parasitizing in SIP requests. Following a firewall-based logic, currently, the parser incorporates 100 different rules organized in four categories (policies) based on the corresponding RFC 4566. Through extensive experimentation, we show that our scheme induces negligible overhead in terms of processing time when working as a software module in either the SIP proxy or a separate machine in front of the latter.