@InProceedings{ IFIPNetworking2014,
	author = "Adnan Aziz and Dirk Hoffstadt and Erwin Paul Rathgeb and Thomas Dreibholz",
	title = "{A Distributed Infrastructure to Analyse SIP Attacks in the Internet}",
	booktitle = "{Proceedings of the IFIP Networking Conference}",
	pages = "1--9",
	numpages = "9",
	day = "4",
	month = jun,
	year = "2014",
	address = "Trondheim, Sør-Trøndelag/Norway",
	language = "english",
	isbn = "978-3-901882-58-6",
	doi = "10.1109/IFIPNetworking.2014.6857088",
	keywords = "VoIP, SIP, SIP Trace Recorder, Misuse, Fraud, Security, Honeynet, Honeypot, Sensor, NorNet, Toll Fraud, Misuse Detection",
	abstract = "{VoIP systems, based on the Session Initiation Protocol~(SIP), are becoming more and more widespread in the Internet. However, this creates security issues and opens up new opportunities for misuse and fraud. The most widespread threat are multi-stage attacks to commit Toll Fraud. To devise effective countermeasures, it is crucial to know how attacks on these systems are performed in reality.
In this paper, we introduce a novel distributed monitoring system with Sensor nodes located in Norway, Germany and China that allow to detect SIP-based attacks from the Internet. Based on experiences from experiments spanning several years, we propose a new setup which allows simple and straightforward addition of new remote observation points. We have deployed this setup in the NorNet testbed and highlight its advantages compared to a previous setup with physically distributed Sensors. We also present results from a 45~day field test with 13 observation points. These results confirm the advantages of a widely distributed monitoring setup and give some new insights into the behavior of the attackers.}",
	url = "https://web.archive.org/web/20241125122924/https://tdr.informatik.uni-due.de/fileadmin/fileupload/I-TDR/Forschung/A_Distributed_Infrastructure_to_Analyse_SIP_Attacks_in_the_Internet.pdf",
	url.size = "744736",
	url.md5 = "06d871da35e30c555878c0f619268135",
	url.mime = "application/pdf",
	url.pagesize = "595.44 x 841.68 pts (A4)",
	url.checked = "2025-03-02 23:20:49 CET",
	note = "{ISBN} 978-3-901882-58-6"
}