On the impacts of low rate DoS attacks on VoIP traffic
Amey Shevtekar, J. Stille, Nirwan Ansari · Security and Communication Networks · 2008
Abstract Low rate TCP DoS (Shrew) and reduction of quality (RoQ) attacks have been proven to be detrimental to TCP traffic in the Internet. In this paper, we investigate the effect of these attacks on QoS sensitive, real time UDP traffic, like VoIP. Both of these attacks are difficult to detect, as the average attack traffic is low. These stealthy RoQ attacks are especially hard to detect as their periodicity is not well‐defined, and the attacks can contain spoofed source as well as destination IP addresses. Extensive ns2 simulations have been performed under realistic scenarios to validate the effects of these attacks on real time VoIP traffic using the G711 and G729a audio codecs. Forward Error Correction (FEC) is also considered in our analysis to recover packets from the packet loss caused by attacks. Without FEC, these attacks can drastically reduce the quality of VoIP traffic, leading to denial of service. To evaluate the perceptual quality of voice under attacks, the network losses are mapped to user's quality perception by using the ITU E‐model. The MOS range of the E‐model decreases frombesttomediumdue to the low rate TCP DoS and RoQ attacks even when FEC is deployed. In some of the attack scenarios, the packet losses are bursty, which can lead to dropped calls. In addition, the stealthy RoQ attacks with higher burst lengths are as effective as the shrew attack in impairing VoIP traffic. We have also evaluated the effects of the attack on the VoIP traffic on the DETERLAB testbed, which has specifically been built for conducting network security research, and the results are consistent with the ns2 simulation results. We believe our investigation is important to remove the misconception about low rate TCP DoS and RoQ attacks that they affect only TCP traffic in the Internet. Copyright © 2008 John Wiley & Sons, Ltd.