## 6 Implementation Results  
Our defensive tool is a DDoS defense solution that was designed exclusively for application-level SIP-based DDoS mitigation. It captures network traffic using the pcap library. As a result, asynchronous data are queued at the kernel level and subsequently analyzed for attack detection. The values for the parameters that are utilized in the calculations are in kilobits per second (kbps). It takes about 4 to 5 s to complete the calculations for the analyses. Our tool can be configured to create pcap files every hour, every day, every week or every month. It also allows us to append to pcap files. For instance, if the application is closed and reopened, it resumes sniffing the network and writing to the end of the existing pcap file from the last session. We utilized SIP-DD, our SIP-based DDoS defense tool, to implement our proposed defense mechanism against the SIP-DRDoS attack. In order to provide a better understanding of the working logic of SIP-DD, we included its pseudocode representation in Figure 7. Additionally, we made the source code for SIP-DD available on GitHub for further reference [[https://github.com/meliht/sip-dd](https://github.com/meliht/sip-dd)]([https://github.com/meliht/sip-dd](https://github.com/meliht/sip-dd)) (accessed on 25 January 2023). For validating the performance of the proposed SIP-based DRDoS attack detection and mitigation mechanism, we conducted several experiments in a laboratory environment that simulated a real enterprise-grade SIP network. In these experiments, we evaluated the following performance metrics:  
* _Detection time_: the time required for the detection module to identify the presence of an attack and trigger the mitigation process;
* _Attack intensity_: the rate at which the attack traffic is generated, measured in packets per second;  
Figure 6: Placement of our proposed defense mechanism on the network. * _CPU usage_: the percentage value of the SIP server's CPU utilization during the attack and the mitigation processes;
* _False positive rate_: the number of legitimate traffic packets that are mistakenly identified as attack traffic and dropped by the mitigation module. We implemented our SIP-DRDoS defense mechanism in our lab environment which simulated a real enterprise-grade SIP network. In the testing environment, where our defense mechanism resided, we first performed the SIP-DRDoS attack given in Section 4 using registered, nonregistered, and random (registered/nonregistered) users. We sent 10 K INVITE packets to the target for 6 min continuously and took performance measurements for the 6 min period from the start of the attack. Resulting from our attack, we observed a traffic intensity of over approximately 1 Gbps at the target. The performance measurements in the first 6 min of the attack (before and after the defense mechanism is activated) are given in Table 2.  
The defense mechanism was initiated as soon as the attack traffic reached the _attack edge_ while the statistics module of our defense system was engaged. When the attack was carried out with random, nonregistered, and registered users, the detection time was found to be 12.2 s, 13.3 s, and 14.6 s, respectively. The inspection module began its investigation by triggering the specially designed dynamic rules to detect the SIP-DRDoS attack. Finally, the action module reduced the load on the target system by dropping attack packets to ensure stability. \begin{table}
\begin{tabular}{p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt}} \hline
**User Type** & **Attack Intensity (pps)** & **CPU Usage during Attack (\%)** & **CPU Usage** & **Detection Time (s)** & **False Positive Rate (\%)** \\ \hline Random & 1,000,000 & 74 & 20 & 12.2 & 0.3 \\ \hline Nonregistered & 1,000,000 & 67 & 17 & 13.3 & 0.2 \\ \hline Registered & 1,000,000 & 72 & 19 & 14.6 & 0.1 \\ \hline \end{tabular}
\end{table} 
Table 2: Performance measurements during the attack and defense periods. Figure 7: Pseudocode for the proposed defense mechanism using SIP-DD.