applied sciences  
A Novel Approach for Efficient Mitigation against the SIP-Based DRDoS Attack  
[PERSON] and [PERSON],*(c)  
estimated to result from the exploitation of device, network, or configuration weaknesses ([[https://www.cfca.org/fraudlosssurvey](https://www.cfca.org/fraudlosssurvey)]([https://www.cfca.org/fraudlosssurvey](https://www.cfca.org/fraudlosssurvey)) (accessed on 25 January 2023)). Internet telephony and video calls are the main applications of SIP [7]. SIP specifies the details of the signaling messages that govern calls between endpoints. It is used to create, modify, and terminate sessions that consist of one or more media streams [8]. In the reflection attack, the victim is tricked to respond to the challenge sent by the attacker. If multipoint communication is performed between the source and destination in a distributed denial-of-service (DDoS) attack, this is called a distributed reflection denial-of-service (DRDoS) attack [9]. In DRDoS attacks, reflectors are used between the source and the destination, which results in dramatically stronger attacks than the traditional DDoS attacks [10; 11]. In this attack, the IP address of the victim is spoofed and a request for information is sent over UDP to reflectors who normally respond to this request [12; 13]. Reflectors respond to the request by sending a message to the victim. In our earlier work, we combined the vulnerabilities in the retransmission and reflection mechanisms of SIP by using the IP spoofing technique [14; 15]. Our resulting attacks proved to bypass existing network protection systems such as firewalls and intrusion detection/prevention systems (IDS/IPS), in addition to black-lists and IP-address/packet-count-based rate-limiting countermeasures. In this paper, we present a novel defense mechanism for mitigating SIP-based DRDoS attacks. Our approach is unique in that it combines both statistical and packet-level analysis to accurately identify and respond to SIP-based DRDoS attacks that are often difficult to detect due to their use of the reflection and the retransmission mechanisms. Overall, our defense mechanism provides a comprehensive approach to mitigating SIP-based DRDoS attacks and can be easily integrated into existing SIP networks. **Our Main Contributions:**  
* We present an improved defense approach and show its efficacy for mitigating the SIP-based DRDoS attack. The proposed enhanced defense mechanism consists of statistics, inspection, and action modules. The statistics module has SIP protocol sniffing and analysis capabilities to perform real-time monitoring of the network traffic and detect attacks. The inspection module has a deep protocol analyzer that is triggered in case of an anomaly. It creates dynamic rate-limiting rules and checks dynamic thresholds by inspecting suspected traffic in regard to SIP specifications. The action module is unique with advanced detection, notification, and action mechanisms that are adapted to the SIP protocol specifications. * To the best of our knowledge, this is the first study to propose a defense mechanism specifically designed to mitigate SIP-based DRDoS attacks. Our approach represents a significant advancement over the existing defense mechanisms that are often limited in their ability to effectively combat these types of attacks. * We implement our defense mechanism successfully in a VoIP/SIP test environment that simulates a real enterprise-grade SIP network. Our experimental results show that our defense mechanism is able to do a deep packet analysis for SIP traffic and detect and mitigate ongoing SIP flood attacks by dropping attack packets and letting only legitimate packets pass through. We show that the CPU usage of the SIP proxy under an SIP-DRDoS attack with around 1 Gbps traffic is effectively reduced from 74% down to 17% within 6 min after our defense mechanism is activated. * Our results demonstrate the potential of our defense mechanism to effectively protect VoIP systems against SIP-based DRDoS attacks which are a significant security threat to these systems.