## 4 Implementing the SIP-DRDoS Attack  
We implemented the SIP-DRDoS attack in a VoIP/SIP test network which emulated an enterprise-grade unified communications environment with all the required software and applications. We realized the SIP registration, session initiation, and termination processes. We used Oracle Virtual Box for virtualization and installing the required operating systems [52]. We used Trixbox, an Asterisk-based IP-PBX system, as our target SIP-PBX in ourexperiments [52] and dedicated a CPU core together with 512 MB memory on a MacBook PC that had a 4-core Intel Core i5 processor running 2.6 GHz and an 8 GB DDR3 memory running at 1600 MHz. By utilizing the widely used softphones Zoiper [53] and X-Lite [54] as our test clients, we simulated various types of SIP traffic and assessed the performance of the target SIP-PBX under different load conditions. Our tool, Mr.SIP [[https://github.com/meliht/mr.sip](https://github.com/meliht/mr.sip)]([https://github.com/meliht/mr.sip](https://github.com/meliht/mr.sip)) (accessed on 25 January 2023), served as a multifaceted tool for simulating and analyzing SIP-based attacks. We used its SIP traffic generator, SIP client simulator, network capturing tool, and stateful SIP message flooding functionalities to perform the SIP-based DRDoS attack and to evaluate the performance of our proposed defense mechanism. We generated random \"INVITE\" messages that complied with the SIP RFCs but contained no specific message patterns to bypass the detection mechanisms of anomaly detection systems. We specified target users in the \"To\" header of \"INVITE\" messages. We enumerated legitimate SIP users and wrote them to a file. We then randomly placed them in the \"To\" headers of generated \"INVITE\" messages. We syntactically generated the \"User-Agent\", \"Via\", \"Contact\" and \"From\" headers of \"INVITE\" messages by randomly selecting information from IP addresses and valid user agent lists. Using valid user agent lists, we randomly and syntactically generated the tag parameter in the \"From\" header, the values in the \"Call-ID\" header, and the source-port and branch parameters in the \"Via\" header. Using IP spoofing, we generated the source IP addresses in the \"Via\" and \"Contact\" headers. We give a pictorial description of the attack flow in Figure 1 and a sample of the INVITE messages used in the attack in Figure 2.  
Figure 1: SIP-DRDoS attack network diagram. Figure 2: SIP DRDoS INVITE message sample. Since UDP is the most widely used transport protocol in SIP systems, we sent our attack messages using UDP. Network scanning and SIP enumeration need to be performed in the initial phases of a DRDoS attack against an SIP system [55]. In our DRDoS attack simulator Mr.SIP, the main components are a network scanner, SIP enumerator and DRDoS attack simulator. Utilizing random SIP message generation, SIP request reflection, and IP spoofing, our simulator successfully bypassed the embedded IDS/IPS mechanisms. We obtained SIP client/server IP addresses and SIP user-IDs by using the network scanner and the SIP enumerator modules of our attack tool Mr.SIP. We gave as input to the network scanner the target IP address range, and the SIP component list was generated as the output. We sent an SIP OPTIONS message to all IP addresses in the provided IP address range over the UDP port 5060. By looking at the response message coming from an IP address, we were able to find out the existence of an SIP component at that address. The device was a potential SIP component if the response message was \"200 OK\". Similar techniques for exploring SIP networks have been previously investigated in [56; 57]. As input to the SIP enumerator module, we provided the output of the network scanner module and obtained the SIP users list. We obtained SIP user information for SIP components by using the SIP enumerator module and sending SIP REGISTER messages to the SIP components in the SIP user list. If a \"401 Unauthorized\" message was returned, we knew that the specified user existed.