Detection and Prevention of SIP REGISTER Injection Attack on a Vo5G Network

Abstract

Recent technological advances have indicated widespread use of Voice Over 5 Generation (Vo5G)
networks based on developing 5G networks. Despite its ease of design and deployment, Vo5G is
vulnerable to many sorts of attacks at the control plane's Session Initiation Protocol (SIP), which
exchanges signaling messages for calls via starting call setups, management, and termination. These
SIP attacks may take the form of modified SIP messages that force the SIP devices to restart, or they
may take the form of flooding the SIP devices with invite messages, register requests that cause the
device to run out of memory, and denying genuine users access to the device. These attacks are
commonly known as Distributed Denial of Service (DDoS) attacks. The SIP register injection attack,
which might be injected during the commencement step by SIP equipped devices (SIP smartphones),
prior to setting up the Secured Internet Protocol (IPsec) tunnel for the remaining SIP sessions, is of
particular relevance, due to its characteristics of exhausting the available bandwidth, memory, and
CPU resources, resulting in SIP device failure. Consequently, there is a need to address this difficulty
by building an SIP register injection attack detection and mitigation technique. Prior to being
processed by the Proxy Call Session Control Function. The proposed scheme verifies each initial
register request from User Equipment (UE) at the home network of Internet Protocol Multimedia
Subsystems (IMS) and compares it to the incoming SIP register request pattern with those stored on the
scheme's table (P-CSCF). The proposed technique detects and drops every SIP register request with an
abnormal pattern that is associated with an attack. The method proved promising with detection
accuracy of over 96.67 percent, which is a solid potential as a preliminary setup towards the creation
of a robust Real-time SIP detection and mitigation scheme for 5G networks.