![](bg3.png)
2 BACKGROUND
2.1 VoIP protocols overview
IP telephony — also known as voice over IP or
VoIP — is becoming a key driver in the evolution of
voice communications. VoIP technology is useful
not only for phones but also as a broad application
platform enabling voice interactions on devices such
as PCs, mobile handhelds, and many vertical-
specific application devices where voice
communication is an important feature.
VoIP traffic over the internet is composed of the
signalling protocols and the media transfer
protocols. Of all the protocols developed over the
years, two have found worldwide acceptance: H.323
(ITU-T, 1998) and SIP (Handley, 1999). H.323 puts
all the signalling intelligence in the core of the
network keeping the endpoints simple. On the other
hand, SIP requires the User Agents at the endpoints
to handle the signalling process. Both H.323 and SIP
provides for call setup, management and media
delivery. The endpoints, which may be physical
phones or software entities, send and receive RTP
packets over UDP/IP that contain encoded voice
conversations. While H.323 uses a set of complex
protocols for call setup and management, SIP relies
on much simpler set of request messages. Due to its
simple design and implementation, SIP is increasing
in popularity, but still H.323 is the most widely
deployed standard.
Since voice traffic can flow between the IP
network and the Public Switched Telephone
Network (PSTN), gateways are needed to perform
translation between the two networks. Such
gateways implement media gateway management
protocols such as MGCP (Arango, 1999) and
Megaco/H.248 (Cuervo, 2000). Figure 1 shows a
converged VoIP network architecture. H.323 and
SIP still remain the base protocols for call
management, while Megaco is the protocol between
the Media Gateway Controller (MGC) and the
Media Gateway (MG). Unlike H.323 or SIP which
uses a peer-to-peer architecture, Megaco adopts a
master/slave architecture for distributed gateways, in
which MGC is the master server and MGs are the
slave clients. The MG terminates PSTN lines and
packetizes media streams for IP transport. The MGC
coordinates setup, handing and termination of media
flows at the MG. The endpoints could be a PSTN
phone, a SIP phone or an H.323 endpoint.
2.1.1 Vulnerabilities in VoIP system
IP telephony-related protocols were not designed
with security as prime design goal. However, some
of these protocols have added security features in
their recent versions. Unfortunately, the security
mechanisms offered by these protocols are not
secure enough or are impractical and hence failed to
achieve worldwide acceptance. It makes it possible
for the attacker to easily forge a packet to launch
attacks such as call hijacking, terminating the calls
abnormally, or toll frauds. Furthermore, denial-of-
service attacks on MGs or misbehaving MGCs are
unavoidable.
Apart from the aforementioned security
problems in signalling, media security is another
issue. Though some protocols allow for encryption
of the media stream, but this solution introduces
extra delay for encryption and decryption. It is,
therefore, not very applicable for VoIP applications
because they are delay and case-sensitive. In
absence of such security mechanism, the packets can
be easily captured and replayed. Also, any garbage
media packets can be directed to the IP address and
UDP port used by the connection. The attacker can
also fake his/her identity by changing the source of
the RTP packets by changing their header.
2.2 Log correlation using mobile
agents
Log correlation refers to the process by which an
IDS combines data captured by multiple sensors, or
the same sensor at different points in time, and tries
to extract significant and broad patterns. A similar
type of attack detected at different points in time, for
example, may indicate an automated, coordinated
attack. In general, the more data that can be
collected related to a specific event, the easier it is
for a security administrator to respond in an
effective manner.
The conventional approach to the log correlation
process involves the collection of distributed sensor
data into a central location, and the application of
searching and data aggregation techniques to
discover patterns. In the context of intrusion
detection, one of the major advantages of the mobile
agent paradigm is the simple model it offers for
distributing computational tasks. Instead of
following the centralized approach, a mobile agent-
based IDS uses agents with analysis capabilities to
perform queries and searches remotely. This is
commonly known as the remote evaluation
technique, which saves bandwidth by taking
advantage of the difference in size between the data
being analyzed, and the code (the analysis agent)
needed to perform the analysis.
ICETE 2004 - SECURITY AND RELIABILITY IN INFORMATION SYSTEMS AND NETWORKS
240