## 2 Related Work
Public Switched Telephone Network (PSTN) and VoIP networking issues were covered extensively in terms of security, and problems such as compromised signaling nodes and spoofed/fabricated signaling messages are explained. A detection and mitigation mechanism for SIP-based DDoS attacks was described in [35; 36]. The focus of these studies was on dumb message flooding attacks. Once an attack was detected, manual action needed to be taken since there was no autresponse mechanism [37; 38]. A rank correlation method (RCM) was proposed to detect DRDoS attacks in [39]. The proposed RCM used the fact that there was an inherent relationship between an attack flow and its corresponding response flow. It also used the fact that converged responsive flows had packet rates that were linearly related. According to simulation results, the RCD method distinguished reflection flows from legitimate flows successfully, and hence it could be used to detect the existence of DRDoS attacks. However, the authors did not apply or mention possible applications of their suggested method in the context of SIP networks [40]. The study in [41] focused on detecting SIP DDoS attacks and identifying attackers. An adaptive cybersecurity monitor was developed with a change-point detector to alert about an ongoing attack and identify malicious users. The main theory of detection was based on the change-point model. While they created an SIP-aware and DDoS-related solution, the study did not mention a reflection attack on the wide DDoS spectrum. In [42], a survey of defense mechanisms against DDoS attacks was given and they were categorized as network/transport-layer-based and application-layer-based defense mechanisms. The network/transport-layer-based mechanisms were further categorized into four as network-based, source-based, destination-based, and hybrid mechanisms. Application-layer-based mechanisms were further classified as destination-based and hybrid mechanisms. SIP flooding attack mitigation was included in the category of application-layer-based mechanisms. In [43], flooding attacks were defined as attacks that exhaust the SIP server memory by abusing the protocol's requirement to store state information. In this study, storing the states of the \"To\", \"From\" and \"Call-ID\" fields were repetitively exploited. Detection and mitigation algorithms were proposed against SIP flooding attacks based on an SIP white-list method. However, the proposed mechanisms did not provide a solution to SIP reflection attacks. In [44], the authors focused on DDoS attacks against Internet-of-things (IoT) devices and highlighted the potential use of blockchain technology to address these attacks. They evaluated various existing blockchain-based solutions for mitigating DDoS attacks in the IoT environment. They surveyed and classified existing solutions into four categories as distributed-architecture-based, access-management-based, traffic-control-based, and Ethereum-platform-based. Furthermore, they analyzed these solutions in terms of their working principles, defense mechanisms, strengths, and weaknesses. While our approach is specifically focused on SIP-based DRDoS attacks and uses techniques such as statistical analysis and packet inspection, this survey paper provided an overview of blockchain-based solutions to mitigate general DDoS attacks. In [45], a Bayesian change-point model was proposed to detect SIP flooding attacks. A real-time traffic simulator was used which was based on social network modeling. In [46], a defense mechanism was proposed for multiattribute flooding attack methods on 10 different attack occasions. In [47], deep learning techniques were used to build and train a model that learned SIP message features automatically and detected DDoS attack patterns efficiently. Our study differs from these studies as our proposed defense mechanism is based on an SIP-based DRDoS mitigation algorithm and utilizes real-time network capturing and data queuing for attack detection and mitigation.