detecting voip based dos attacks at the public safety answering point
In the recent years Voice over IP (VoIP) telephony started to migrate from research to the market. In the future, All-IP networks will substitute the classical Public Switched Telephone Networks (PSTNs). Nowadays, there is no All-IP network yet, but many VoIP-providers already enable calls from VoIP to a PSTN and vice versa. Thus, critical infrastructures within the PSTN like the emergency call service, are accessible from the VoIP network (e.g. the Internet) and get exposed to new security threats. In particular, there is the risk of Denial of Service (DoS) attacks originating from the VoIP network. An attacker could jam the emergency call service by generating a massive load of faked emergency calls, which could lead to the loss of lives in the worst case. For us, this was the motivation to analyse the applicability of the concept of Intrusion Detection (ID) in the emergency call context and develop an adapted ID-architecture including its implementation. In an evaluation of the ID-architecture, using real emergency call traces from the fire department of Cologne, we show that the developed concept can reliably detect emerging DoS attacks from VoIP networks up to a certain VoIP diffusion rate.
voip emergency calls denial of service intrusion detection 911 psap