On Sliding Window Based Change Point Detection for Hybrid SIP DoS Attack

As the core infrastructure of the VoIP, IMS and IPTV, SIP based network is now increasingly been deployed throughout the world. Due mainly to the relatively high flow rate and the exorbitant session maintenance, SIP servers are similarly susceptible to the Denial-of-Service (DoS) Attacks above the IP stack, especially when the Distributed spoofing URI is considered. A hybrid SIP DoS detection method is proposed in this paper to handle three representative flooding attacks, and the CUSUM statistical detection founded on the adaptive sliding window based acquisition is adopted for achieving high accuracy and low latency. Experimental result shows that this method achieves a high rate, low latency and low false alarm rate of SIP flooding detection.