The Session Initiation Protocol (SIP) is a two-way communication method, and it is a connection oriented data communication, which means any sent request must be acknowledged with a response. However, as the internet is a packet switching communication network, it is always possible and expected to miss a few responses for their correspondent sent requests; so within any period, there will be always a time ratio between the total number of NON-acknowledged and their sent responses requests. The previous concept is very useful to aid in detecting any sudden Denial of Service (DoS) flood towards any SIP targeted victim, when the victim gets busy in processing the received traffic, which means less acknowledged responses for every received request, and by result, this will increase the ratio of the NON-acknowledged sent responses and the received requests. Two different sets of traffic were tested in the current research; the first set was generated by the simulation methods which were used in the research, the second set of traffic was obtained from another research that adopted the same idea of SIP two-way communications [45]. The first generated set was tested into two different scenarios according to how steep is the increase of the incoming requests, and the differences between the incoming requests and the acknowledged responses. The first scenario shows the case of a sudden high steep increase in the incoming traffic with much less acknowledgments which means a subjectively large difference, and the second scenario shows the case of a low sudden steep increase in the incoming traffic with less differences in the acknowledgments. The second scenario represents a low and slow flooding DoS attack which targets a SIP victim. In each scenario, two cases were tested. The first case was by previously finding the mean ( ) and the standard deviation ( ) µ σ of the whole sequence of the observed ratios, then finding the CUSUM or EWMA values, and this case represents a system which monitors the traffic and having previous knowledge about the traffic. The second case in CUSUM or EWMA calculations is by updating the mean and the standard deviation right after getting a new observation ratio, and then finding the new CUSUM or EWMA values. Both ways of calculations have shown significant results; the first case has an advantage of reducing the overhead spent in the computations, while the advantage of the second case was to present how a system with no previous experience or knowledge of the ongoing traffic can adapt the CUSUM and EWMA to detect any sudden change in that traffic.
The Session Initiation Protocol (SIP) is a two-way communication method, and it is a connection oriented data communication, which means any sent request must be acknowledged with a response. However, as the internet is a packet switching communication network, it is always possible and expected to miss a few responses for their correspondent sent requests; so within any time period, there will be always a ratio between the total number of NON-acknowledged responses and their sent requests. The previous concept is very useful to aid in detecting any sudden Denial of Service (DoS) flood towards any SIP targeted victim, when the victim gets busy in processing the received traffic, which means less acknowledged responses for every received request, and by result, this will increase the ratio of the NON-acknowledged sent responses and the received requests. Two different sets of traffic were tested in the current research; the first set was generated by the simulation methods which were used in the research, the second set of traffic was obtained from another research that adopted the same idea of SIP two-way communications [45]. The first generated set was tested into two different scenarios according to how steep is the increase of the incoming requests, and the differences between the incoming requests and the acknowledged responses. The first scenario shows the case of a sudden high steep increase in the incoming traffic with much less acknowledgments which means a subjectively large difference, and the second scenario shows the case of a low sudden steep increase in the incoming traffic with less differences in the acknowledgments. The second scenario represents a low and slow flooding DoS attack which targets a SIP victim. In each scenario, two cases were tested. The first case was by previously finding the mean ( µ ) and the standard deviation ( σ ) of the whole sequence of the observed ratios, then finding the CUSUM or EWMA values, and this case represents a system which monitors the traffic and having previous knowledge about the traffic. The second case in CUSUM or EWMA calculations is by updating the mean and the standard deviation right after getting a new observation ratio, and then finding the new CUSUM or EWMA values. Both ways of calculations have shown significant results; the first case has an advantage of reducing the overhead spent in the computations, while the advantage of the second case was to present how a system with no previous experience or knowledge of the ongoing traffic can adapt the CUSUM and EWMA to detect any sudden change in that traffic.
Detection%20of%20Denial%20Of%20Service%20Attacks%20on%20Application%20Layer%20Protocol.docx