## 2 Related Work  
Denial-of-service (DoS) attacks can target any network element to disrupt the networking capabilities of the network element or the functionality of the whole system. They are considered to be one of the most alarming threats to the Internet [16; 17; 18; 19]. DoS attacks against SIP systems can be classified into five categories as malformed message, spoofed message, invalid message flooding, legitimate message flooding, and DRDoS attacks [17]. Various SIP-based DoS attacks and associated defense mechanisms are proposed in the literature [20; 21]. An RTP flooding attack is a flooding attack that causes a huge amount of valid Real-time Transport Protocol (RTP) traffic filled with bytes in a random fashion [22]. The attack keeps its target clients in the dialog phase and exhausts their bandwidth, causing the SIP server to be overloaded with unwanted traffic. A detection technique for SIP-based RTP flooding attack, named packet inspection statistical technique (PIS), was proposed in [23; 24]. The proposed technique comprised an initial feature extraction stage and a decision stage. The technique used the Hellinger distance parameter to compute the difference between the training and test traffic. It used the attributes INVITE, 200 OK, BYE, and ACK and aimed to augment the robustness of VoIP Networks by predicting RTP attacks. However, the technique was shown to lack efficacy in real-time applications. A VoIP fraud detection technique was proposed in [25]. The history of user profiles was recorded in a configurable manner where an administrator chose thresholds and time frames for training and profiling. In case of suspicious activity, an alarm was generated. Alarms were eventually correlated with intrusion detection systems to avoid false positives. The proposed method was effective against session hijacking through spoofing [26]; however, it did not provide support for reflection attack protection or anomaly-based detection [27]. In a study on dark-net-inflicted attacks on the global network, the Sality SIP-scan botnet was described [28]. Although this study was not straightly focused on VoIP systems, it provided detailed information on amplification attacks [29]. A defense and monitoring model was proposed against DDoS attacks in [30]. The suggested mitigation scenarios included analyzing the network-wide DDoS security anomalies, e.g., by finding correlations with publicly available data from other networks [31]. They introduced a monitoring scheme that simulated different attacks, estimated the strength of DDoS attacks, and ultimately diminished and prevented them. A reconfigurable real-time testbed was proposed to measure the impact of firewalls and data/voice network separation mechanisms on VoIP services [32]. The testbed enabled three levels of security, low, medium, and high, in real operating conditions. Simulations were done on a QoS basis, allowing users to test the security policies with given constraints such as network configuration, operating conditions, etc. A technique for exploiting a VoIP softphone vulnerability was proposed in [33]. The proposed technique disabled a host by crafting SIP traffic which consumed all free memory in minutes. The authors also proposed a mitigation technique that used a context-aware filter. With the leverage of context and SIP protocol information, it became possible to deduce an SIP message that was impersonating a client. The mitigation method was fairly straightforward since softphones use predictable port numbers. Network address translation (NAT) implementation was argued to be useful for this particular purpose. Other than network-based mitigation, SIP authentication, when enforced on users, was an efficient way to mitigate such attacks. A survey of attacks on VoIP systems, such as DoS, packet spoofing and masquerading, eavesdropping, VoIP spam and toll fraud, and related countermeasures were listed in [34].