A signature database for intrusion detection systems targeting voice over Internet protocol environments

Abstract

The unique features of voice over Internet protocol (VoIP) systems introduce various security challenges which entail novel detection approaches. Signature-based detection approaches have been lacking the necessary flexibility to model attacks semantically and to thwart obfuscation. In this paper, we demonstrate the design and implementation of a signature database that complements a specification-based detection module in an intrusion detection system (IDS) that targets VoIP environments. Our design models attacks at the session higher level and provides an effective solution against obfuscation attempts. The hit rate and performance evaluation figures shown by the database attest the quality of the design.