1. Fraunhofer FOKUS 2007 VoIP Defender The Future of VoIP Protection Fraunhofer FOKUS Institute, Germany

2. Fraunhofer FOKUS 2007 VoIP-Defender – Why ? Steadily increasing number of Customers makes VoIP a first class target for attackers. Aimed at The Service itself (E.g. DDos, Spoofing) The Customer (SPIT, Fraud, Call-Hijacking) The Service Provider (E.g. SQL-Injection) Already observed REGISTER / INVITE flooding Multi-Source flooding Unresolvable DNS Names Unintentional misbehavior / misconfiguration (Not an attack) What will we see tomorrow ???

3. Fraunhofer FOKUS 2007 VoIP-Defender – What is it ? VoIP-Defender is a Framework for Detection Algorithms. Highly Scalable Cope with high bandwidth attacks, especially DoS. Multiple scalability levels plus parallel processing. Invisible placing Attackers cannot see the presence of the VoIP-Defender. Autonomously working No support from proxy needed, thus proxy agnostic. Traffic pass-through by default. Intelligent monitoring and defence Especially designed for SIP networks Includes SIP/IMS parser, SIP state machine, SIP properties See actual ongoing SIP network traffic Monitoring and defence algorithms dynamically en- / disabled Already multiple monitoring and detection algorithms User Control Interface – Terminal, GUI

4. Fraunhofer FOKUS 2007 VoIP-Defender – Where Is It ? VoIP-Defender is placed between the Service provisioning Platform and the Customers. Classical Firewall Position. Multi-Link Monitoring & Protection possible. Legal Users Attacker VoIP-DefenderServices

5. Fraunhofer FOKUS 2007 Algorithmic knowledge VoIP-Defender – Architecture Overview Transport Level Load Balancers (TLLB) Filter/Scanner Nodes (FSN) Analyzers (Algorithms parallel Part) Deciders (Algorithms sequential Part) FSN TLLB Alg1Alg2 Analyzer 1 Alg1Alg2 Analyzer 2 Alg1Alg2 Decider plane Rules Traffic Reconstructed Messages Internet Service

6. Fraunhofer FOKUS 2007 VoIP-Defender – Architecture Transport Level Load Balancing MAC Layer Transparent Simple Load balancing by Information from up to the Transport Layer. Incoming packets from the same source IP address are sent out via the same Port (mapping). Outgoing packets to unassociated IP addresses also create a mapping. Clients Mappings Ports FSN1 FSN2 FSN3 TLLB Internet Side TLLB Incoming Outgoing

7. Fraunhofer FOKUS 2007 VoIP-Defender – Architecture Transport Level Load Balancing Outgoing packets to the same source IP address are sent out via the same Port (mapping). Incoming packets from unassociated IP addresses also create a mapping. Service Mappings Ports FSN1 FSN2 FSN3 TLLB Service Side TLLB Incoming Outgoing

8. Fraunhofer FOKUS 2007 VoIP-Defender – Architecture Filter & Scanner Node IP defrag UDPTCP SIP extractor Rule Processing Frame Cache Frames Verdict Analyzer selection User Space Kernel Space Bridge User Space Message Inspection Filter Rule Control Analyzer Incoming Outgoing Decider SIP + Meta

9. Fraunhofer FOKUS 2007 VoIP-Defender – Architecture Filter & Scanner Node A UDP Packet arrives IP defrag UDPTCP SIP extractor Rule Processing Frame Cache Analyzer selection User Space Kernel Space Bridge User Space Message Inspection Filter Rule Control Analyzer Incoming Decider SIP + Meta

10. Fraunhofer FOKUS 2007 VoIP-Defender – Architecture Filter & Scanner Node The Frame is forked. One copy for the Frame Cache, another one for Analysis IP defrag UDPTCP SIP extractor Rule Processing Frame Cache Frames Analyzer selection User Space Kernel Space Bridge User Space Message Inspection Filter Rule Control AnalyzerDecider SIP + Meta

11. Fraunhofer FOKUS 2007 VoIP-Defender – Architecture Filter & Scanner Node The Packet is inspected for completeness in terms of IP, UDP and SIP IP defrag UDPTCP SIP extractor Rule Processing Frame Cache Analyzer selection User Space Kernel Space Bridge User Space Message Inspection Filter Rule Control AnalyzerDecider SIP + Meta

12. Fraunhofer FOKUS 2007 VoIP-Defender – Architecture Filter & Scanner Node Potentially many packets be necessary to assemble to a complete SIP message. This one is incomplete. IP defrag UDPTCP SIP extractor Rule Processing Frame Cache Analyzer selection User Space Kernel Space Bridge User Space Message Inspection Filter Rule Control AnalyzerDecider SIP + Meta

13. Fraunhofer FOKUS 2007 VoIP-Defender – Architecture Filter & Scanner Node The rest of the SIP message arrives IP defrag UDPTCP SIP extractor Rule Processing Frame Cache Analyzer selection User Space Kernel Space Bridge User Space Message Inspection Filter Rule Control Analyzer Incoming Decider SIP + Meta

14. Fraunhofer FOKUS 2007 VoIP-Defender – Architecture Filter & Scanner Node Also duplicated, one for the Intelligence, one for the Frame Cache IP defrag UDPTCP SIP extractor Rule Processing Frame Cache Analyzer selection User Space Kernel Space Bridge User Space Message Inspection Filter Rule Control AnalyzerDecider SIP + Meta Frames

15. Fraunhofer FOKUS 2007 VoIP-Defender – Architecture Filter & Scanner Node Again checked for completeness. IP defrag UDPTCP SIP extractor Rule Processing Frame Cache Analyzer selection User Space Kernel Space Bridge User Space Message Inspection Filter Rule Control AnalyzerDecider SIP + Meta

16. Fraunhofer FOKUS 2007 VoIP-Defender – Architecture Filter & Scanner Node As soon as the SIP message is complete, 1.An Analyzer is selected by determining a session ID, and the SIP message is sent to it along with meta information about the involved transport. 2.The SIP message is examined by the currently active rule set. IP defrag UDPTCP SIP extractor Rule Processing Frame Cache Analyzer selection User Space Kernel Space Bridge User Space Message Inspection Filter Rule Control AnalyzerDecider SIP + Meta

17. Fraunhofer FOKUS 2007 VoIP-Defender – Architecture Filter & Scanner Node Here, the message has been found to be OK, so all its Frames (2) are allowed to be sent out. IP defrag UDPTCP SIP extractor Rule Processing Frame Cache OK Verdict: OK Analyzer selection User Space Kernel Space Bridge User Space Message Inspection Filter Rule Control AnalyzerDecider SIP + Meta

18. Fraunhofer FOKUS 2007 VoIP-Defender – Architecture Rules Rules are based on any Protocol Information. Regular Expressions enable filtering by Content. Scripting Rules allow even more complex Operations (Requires User Space Filtering Support on the FSNs) OK: The frames are sent out in the correct order DROP: UDP: Frames are simply dropped. TCP: Connection is interrupted by injecting RST frames.

19. Fraunhofer FOKUS 2007 VoIP-Defender – Architecture Analyzer & Decider Detection Algorithms are split into a scalable part and an non-scalable part. The scalable part is realized in the Analyzers. The non-scalable part is realized in the Decider. Example: INVITE flooding from single source. Parsing INVITE ? Extract SRC increase counter for this SRC Trigger Alarm Parsing INVITE ? Extract SRC increase counter for this SRC Trigger Alarm increase counter for this SRC Trigger Alarm Parsing INVITE ? Extract SRC Parsing INVITE ? Extract SRC Analyzer Decider

20. Fraunhofer FOKUS 2007 VoIP-Defender – Architecture Analyzer Analyzers implement the scalable part of detection Algorithms in VoIP-Defender. It is granted, that every SIP message, that belongs to the same session is processed by the same Analyzer. APIs for algorithm programmers, offering Effective SIP parsing Access to Transport Information Protocol Fragments Transmission time and duration SRC/DST IP-Address Port Numbers Network Communication with the Decider

21. Fraunhofer FOKUS 2007 VoIP-Defender – Architecture Analyzer Report Server (listens for incoming messages & reports from FSNs) SIP Parser (pre-parses incoming SIP messages ) Parsed SIP Msg Algorithm Dispatcher (Calls each analyzer in order with the current parsed SIP message) Incoming Msg Buffer Result Client (send individual result information to decider layer) stores access Results / Status State Analyzer Component (Algorithm 1) Meta Data provides Decider connection Control Interface (GUI interaction) State Analyzer Component (Algorithm 2) State Analyzer Component (Algorithm 3) GUI connection FSN connections

22. Fraunhofer FOKUS 2007 VoIP-Defender – Architecture Decider The Decider implements the non-scalable (common knowledge) part of detection Algorithms in VoIP-Defender. It receives algorithm specific reports from the Analyzers and dispatches them to the specific Decider Modules. APIs for algorithm programmers, offering Rule Management Inter-Algorithm Communication Network Communication with Analyzers and FSNs

23. Fraunhofer FOKUS 2007 VoIP-Defender – Architecture Decider Result Server (listens for incoming result reports from analyzer layer) Event Manager (dispatches events send to and by algorithms) Rule Control (send control commands to FSN) Incoming result State Decider Component (Algorithm 1) Create rules FSN connections Timers Rule Cache (keeps current rules locally) State Decider Component (Algorithm 2) State Decider Component (Algorithm 3) State Decider Component (Algorithm 4) Control Interface Results Analyzer connections

24. Fraunhofer FOKUS 2007 VoIP-Defender – Next Steps Develop and implement more detection Algorithms. Real-World Deployment at a professional VoIP Provider. Architectural Refinements. Dedicated IMS Support.

25. Fraunhofer FOKUS 2007 VoIP-Defender Thanks – Questions ?