SIP-DDoS: SIP Framework for DDoS Intrusion Detection Based on Recurrent Neural Networks

Abstract

The rapid evolution of beyond fifth-generation (B5G) and sixth-generation (6G) networks has significantly driven the growth of Internet of Things (IoT) applications. These applications are characterised by: a massive connectivity, high security level, trust, wireless coverage, also ultra-low latency, high throughput, and ultra-reliability, especially for real-time oriented sessions or sensor like cameras. While traditional protocols like MQTT and CoAP are inadequate for such types of applications, under certain conditions, the 3GPP standard Session Initiation Protocol (SIP) emerges as a promising solution. However, SIP faces various Distributed Denial of Service (DDoS) threats, as INVITE flooding attacks presenting a significant challenge. This work presents a GRU-based Intrusion Detection System (IDS) to detect SIP-INVITE flooding attacks. Leveraging recurrent neural networks, the IDS efficiently process sequential SIP traffic data in real time, identifying attack patterns effectively. The GRU’s ability to capture temporal dependencies enhances accuracy in classifying and detecting attack behaviors. The results demonstrate that the framework can effectively detect and mitigate INVITE flooding attacks of different intensities, under practical settings. The performance results show that the proposed framework is robust and can be practically deployed, e.g., inference time less than 800 $\upmu$s and a marginal rate for the misclassified traffic.