Voice over IP (VoIP) has emerged as a technology for carrying voice, video, and multimedia traffic over the Internet. A suite of VoIP protocols has evolved to cover many aspects of carrying calls over the Internet, including signaling, media transport, session routing, quality of service, and interfacing with the public switched telephone network (PSTN).
VoIP has become a target of denial of service (DoS) attacks, in which an attacker attempts to prevent legitimate users of a service from using that service. The ubiquitous and open nature of telecommunication networks, coupled with the importance of these networks, makes detection and prevention of denial-of-service attacks a priority for both network access and service providers. Some network infrastructure providers have responded by installing threat-specific router filters to lessen the exposure to certain denial-of service attacks. For example, the industry standard RFC 2827 describes a best practices solution for prohibiting denial-of-service attacks which use forged Internet protocol (IP) addresses propagated from behind an Internet service provider's aggregation point. Unfortunately, these threat-specific filters leave networks and network coupled resources open to new attacks.
Network managers can employ several techniques for reducing the threat of an attack. For example, disabling unused or unneeded network services, enabling quota systems within operating systems, and separating critical functions from other data partitions and volumes (i.e., separately mounted file systems with independent attributes). Some of these techniques limit the ability of an intruder to take advantage of available services but can result in an unintentional reduction in capability for legitimate network users. Other techniques, such as network monitoring, are labor intensive and subject to interpretation of what constitutes ordinary activity regarding data manipulation, CPU usage, and network traffic.
The signaling protocols used in VoIP are particularly vulnerable to DoS attacks. These protocols have relatively long timeouts, and a delay in responding to a request triggers a series of retries, one after the other, which only increases the traffic. Furthermore, parsing of signaling packets is time consuming, since these protocols are located relatively high up in the protocol stack. Thus, a common response to a DoS attack is to simply drop signaling packets at random during the attack.
Therefore, further improvements to systems and methods for preventing denial-of-service attacks are desired.