Detection and Prevention of SIP REGISTER Injection Attack on a VoLTE Network

Recent technological advances have indicated widespread use of Voice Over Long-Term Evolution (VoLTE) networks based on developing 5G networks. Despite its ease of design and deployment, VoLTE is vulnerable to many sorts of attacks at the control plane's Session Initiation Protocol (SIP), which exchanges signaling messages for calls via starting call setups, management, and termination. These SIP attacks may take the form of modified SIP messages that force the SIP devices to restart, or they may take the form of flooding the SIP devices with invite messages, register requests that cause the device to run out of memory, and denying genuine users access to the device. These attacks are commonly known as Distributed Denial of Service (DDoS) attacks. The SIP register injection attack, which might be injected during the commencement step by SIP equipped devices (SIP smartphones), prior to setting up the Secured Internet Protocol (IPsec) tunnel for the remaining SIP sessions, is of particular relevance, due to its characteristics of exhausting the available bandwidth, memory, and CPU resources, resulting in SIP device failure. Consequently, there is a need to address this difficulty by building an SIP register injection attack detection and mitigation technique. Prior to being processed by the Proxy Call Session Control Function. The proposed scheme verifies each initial register request from User Equipment (UE) at the home network of Internet Protocol Multimedia Subsystems (IMS) and compares it to the incoming SIP register request pattern with those stored on the scheme's table (P-CSCF). The proposed technique detects and drops every SIP register request with an abnormal pattern that is associated with an attack. The method proved promising with detection accuracy of over 96.67 percent, which is a solid potential as a preliminary setup towards the creation of a robust Real-time SIP detection and mitigation scheme for 5G networks.