SIP-Based VoIP Traffic Behavior Profiling and Its Applications

With the widespread adoption of session Session Initiation Protocol (SIP)-based Voice-overIP (VoIP), understanding the characteristics of SIP traffic behavior is critical to problem diagnosis and security protection of IP telephony. In this topic, we propose a general
methodology for profiling SIP-based VoIP traffic behavior at multiple levels: SIP server host, server entity (e.g., registrar and call proxy), and individual user levels. Using SIP traffic traces captured in a production VoIP service, we illustrate the characteristics of SIP-based VoIP traffic behavior in an operational network and demonstrate the effectiveness of our general profiling methodology. In particular, we show how our profiling methodology can help identify performance anomalies through a case study. We also demonstrate the efficacy of our methodology in detecting potential VoIP attacks through testbed experimentation.