Complex Distributed Telephony Denial of Service (TDoS) Defense

TDoS is a form of DoS that affects government, enterprise, and small business voice systems. It is the most significant threat to voice systems and by far the most likely form of voice-based DoS. TDoS attackers use SIP, free IP-PBXs, call generators, and spoofed calling numbers to cheaply and anonymously flood their victims with calls. The attackers have the advantage, because attacks are easy to generate, victims often have a small number of critical phones and attendants that are easily overwhelmed, and have little capability to mitigate the attacks. The state of the art in mitigation is largely static black and white lists in PBXs, SBCs, and service provider networks. Plus, by spending just a little more effort, attackers can make their attacks much more complex and difficult to mitigate. Soon the ability to generate very large distributed TDoS attacks will also be possible, increasing the list of potential victims. The proposed project will define a defense for these types of attacks. Attack signatures for future attacks will be defined. A robust defense approach consisting of multiple levels of filters, which inspect the signaling for all calls, use network probes for some calls, and using Turing Tests and content analysis for other calls, all configured with flexible policies and business rules, will be defined. A proof-of-concept implementing the most promising filters and techniques will be built upon the commercial SecureLogix voice security product. This will provide a foundation for a Phase II effort and rapid transition to a commercial product.