1. TEL500-Voice Communications SIP-based VoIP Traffic Behavior Profiling and Its Application Devesh Mendiratta & Sameer Deshmukh MS-Telecommunication State University of New York Institute of Technology

2. Introduction to Paper  SIP based VOIP Traffic Behavior at levels like  SIP server entity  SIP server host  Individual user levels  Security of VOIP – Attacks & vulnerability  Paper claims : Little research As of now  1 st attempt to understand SIP traffic behavior for Attack Detection

3. Outline  SIP Overview  Identifying SIP servers  Profiling SIP sever & User Behaviors  Characteristics of Behavior  Applications  Conclusion

4. SIP Based VoIP Service SIP servers and clients  SIP REGISTER  Call Proxy  Request-Response  Method field  FROM and TO fields

5. Identifying IP Address  Observation of SIP servers  Large No. of SIP messages  Large No. of distinct FROM and TO fields

6. Profiling SIP Server Behaviors Multilevel Profiling Three Levels:  Server host level: maintain only aggregate features and metrics by examining only the message types into and out of a SIP server  Server entity level: separate the role of a SIP server into register and call proxy  User level: attribute the SIP messages to individual users and maintain statistic and features to characterized individual user behaviors

7. Server Host Level Characterization  Count the number of request and response messages received and sent by each SIP server over a given period of time T  Count the number of unique users seen in the FROM and TO fields of SIP request messages, and compute an aggregate user activity diversity from the distribution of data over T

8. Overall Server Level Characteristics No. of message typesUser activities diversity (Metric)

9. Registrar Behavior Characteristics Period of registration updates Requests inter-arrival times

10. Call Proxy/User Call Behavior Characteristics Calls made vs. receivedCall types

11. Applications

12. Conclusion  VOIP traffic consists of stable characteristics  Well captured by statistics & features of profile we use  Profiling – to help identify the attack detection

13. ? Thank You Any Questions Undergrad ???