{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,22]],"date-time":"2026-01-22T01:43:20Z","timestamp":1769046200861,"version":"3.49.0"},"reference-count":43,"publisher":"MDPI AG","issue":"20","license":[{"start":{"date-parts":[[2020,10,17]],"date-time":"2020-10-17T00:00:00Z","timestamp":1602892800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100011665","name":"Deanship of Scientific Research, King Saud University","doi-asserted-by":"publisher","award":["RG-1439\u2013039"],"award-info":[{"award-number":["RG-1439\u2013039"]}],"id":[{"id":"10.13039\/501100011665","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Many companies have transformed their telephone systems into Voice over IP (VoIP) systems. Although implementation is simple, VoIP is vulnerable to different types of attacks. The Session Initiation Protocol (SIP) is a widely used protocol for handling VoIP signaling functions. SIP is unprotected against attacks because it is a text-based protocol and lacks defense against the growing security threats. The Distributed Denial of Service (DDoS) attack is a harmful attack, because it drains resources, and prevents legitimate users from using the available services. In this paper, we formulate detection of DDoS attacks as a classification problem and propose an approach using token embedding to enhance extracted features from SIP messages. We discuss a deep learning model based on Recurrent Neural Networks (RNNs) developed to detect DDoS attacks with low and high-rate intensity. For validation, a balanced real traffic dataset was built containing three attack scenarios with different attack durations and intensities. Experiments show that the system has a high detection accuracy and low detection time. The detection accuracy was higher for low-rate attacks than that of traditional machine learning.<\/jats:p>","DOI":"10.3390\/s20205875","type":"journal-article","created":{"date-parts":[[2020,10,17]],"date-time":"2020-10-17T05:45:51Z","timestamp":1602913551000},"page":"5875","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":29,"title":["Countering DDoS Attacks in SIP Based VoIP Networks Using Recurrent Neural Networks"],"prefix":"10.3390","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3153-4251","authenticated-orcid":false,"given":"Waleed","family":"Nazih","sequence":"first","affiliation":[{"name":"College of Computer Engineering and Sciences, Prince Sattam Bin Abdulaziz University, Al Kharj 11942, Saudi Arabia"},{"name":"Faculty of Computers and Information Sciences, Ain Shams University, Abassia, Cairo 11566, Egypt"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5516-7225","authenticated-orcid":false,"given":"Yasser","family":"Hifny","sequence":"additional","affiliation":[{"name":"Faculty of Computers and Information, Helwan University, Ain Helwan, Cairo 11795, Egypt"}]},{"given":"Wail S.","family":"Elkilani","sequence":"additional","affiliation":[{"name":"Faculty of Computers and Information Sciences, Ain Shams University, Abassia, Cairo 11566, Egypt"},{"name":"College of Applied Computer Sciences (CACS), King Saud University, Riyadh 11543, Saudi Arabia"}]},{"given":"Habib","family":"Dhahri","sequence":"additional","affiliation":[{"name":"College of Applied Computer Sciences (CACS), King Saud University, Riyadh 11543, Saudi Arabia"},{"name":"Faculty of Sciences and Technology, University of Kairouan, Sidi Bouzid 4352, Tunisia"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4060-2535","authenticated-orcid":false,"given":"Tamer","family":"Abdelkader","sequence":"additional","affiliation":[{"name":"Faculty of Computers and Information Sciences, Ain Shams University, Abassia, Cairo 11566, Egypt"}]}],"member":"1968","published-online":{"date-parts":[[2020,10,17]]},"reference":[{"key":"ref_1","unstructured":"Cisco (2020, June 07). Cisco Visual Networking Index: Forecast and Trends, 2017\u20132022 White Paper. Available online: http:\/\/goo.gl\/X3efVF."},{"key":"ref_2","unstructured":"Nettitude (2020, June 07). VoIP Attacks on the Rise. Available online: https:\/\/www.nettitude.com\/uk\/."},{"key":"ref_3","unstructured":"Jacobson, V., Frederick, R., Casner, S., and Schulzrinne, H. (2020, June 15). RTP: A Transport Protocol for Real-time Applications. Available online: https:\/\/tools.ietf.org\/html\/rfc3550."},{"key":"ref_4","unstructured":"Rosenberg, J. (2020, June 15). SIP: Session Initiation Protocol. Available online: https:\/\/tools.ietf.org\/html\/rfc3261."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"514","DOI":"10.1109\/SURV.2011.031611.00112","article-title":"A comprehensive survey of voice over IP security research","volume":"14","author":"Keromytis","year":"2011","journal-title":"IEEE Commun. Surv. Tutorials"},{"key":"ref_6","unstructured":"Cooney, M. (2020, June 07). IBM Warns of Rising VoIP Cyber-attacks, Technical Report. Available online: https:\/\/bit.ly\/3eYnZuI."},{"key":"ref_7","unstructured":"Zar, J. (2020, June 07). VoIP Security and Privacy Threat Taxonomy. Available online: https:\/\/ci.nii.ac.jp\/naid\/10018745638\/en\/?range=0&sortorder=1&start=1&count=20."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"325","DOI":"10.1007\/s12243-017-0567-6","article-title":"Security and management framework for an organization operating in cloud environment","volume":"72","author":"Raza","year":"2017","journal-title":"Ann. Telecommun."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Tsiatsikas, Z., Fakis, A., Papamartzivanos, D., Geneiatakis, D., Kambourakis, G., and Kolias, C. (2015, January 20\u201322). Battling against DDoS in SIP: Is Machine Learning-based detection an effective weapon?. Proceedings of the 2015 12th International Joint Conference on e-Business and Telecommunications (ICETE), Colmar, France.","DOI":"10.5220\/0005549103010308"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"48","DOI":"10.1016\/j.dsp.2017.10.009","article-title":"A Bayesian change point model for detecting SIP-based DDoS attacks","volume":"77","author":"Kurt","year":"2018","journal-title":"Digital Signal Process."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Saon, G., Kuo, H.K.J., Rennie, S., and Picheny, M. (2015). The IBM 2015 English conversational telephone speech recognition system. arXiv.","DOI":"10.21437\/Interspeech.2015-632"},{"key":"ref_12","unstructured":"Oord, A.v.d., Dieleman, S., Zen, H., Simonyan, K., Vinyals, O., Graves, A., Kalchbrenner, N., Senior, A., and Kavukcuoglu, K. (2016). Wavenet: A generative model for raw audio. arXiv."},{"key":"ref_13","unstructured":"Sutskever, I., Vinyals, O., and Le, Q.V. (2014, January 8\u201313). Sequence to sequence learning with neural networks. Proceedings of the Neural Information Processing Systems 2014, Montreal, QC, Canada."},{"key":"ref_14","unstructured":"Krizhevsky, A., Sutskever, I., and Hinton, G.E. (2012, January 3\u20138). Imagenet classification with deep convolutional neural networks. Proceedings of the Neural Information Processing Systems 2012, Lake Tahoe, NV, USA."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"41525","DOI":"10.1109\/ACCESS.2019.2895334","article-title":"Deep learning approach for intelligent intrusion detection system","volume":"7","author":"Vinayakumar","year":"2019","journal-title":"IEEE Access"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"436","DOI":"10.1038\/nature14539","article-title":"Deep learning","volume":"521","author":"LeCun","year":"2015","journal-title":"Nature"},{"key":"ref_17","first-page":"491","article-title":"Securing SIP-based VoIP infrastructure against flooding attacks and Spam over IP Telephony","volume":"38","author":"Akbar","year":"2014","journal-title":"KAIS"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"582","DOI":"10.1109\/TDSC.2014.2302298","article-title":"SIP flooding attack detection with a multi-dimensional sketch design","volume":"11","author":"Tang","year":"2014","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"29","DOI":"10.1016\/j.cose.2016.08.007","article-title":"Novel session initiation protocol-based distributed denial-of-service attacks and effective defense strategies","volume":"63","author":"Tas","year":"2016","journal-title":"Comput. Secur."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"618","DOI":"10.1016\/j.cose.2017.08.003","article-title":"Protecting from Cloud-based SIP flooding attacks by leveraging temporal and structural fingerprints","volume":"70","author":"Dassouki","year":"2017","journal-title":"Comput. Secur."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"137","DOI":"10.1016\/j.comnet.2018.02.025","article-title":"An intelligent cyber security system against DDoS attacks in SIP networks","volume":"136","author":"Semerci","year":"2018","journal-title":"Comput. Netw."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"518","DOI":"10.15837\/ijccc.2019.4.3563","article-title":"Efficient Detection of Attacks in SIP Based VoIP Networks using Linear l1-SVM Classifier","volume":"14","author":"Nazih","year":"2019","journal-title":"Int. J. Comput. Commun. Control"},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"2401","DOI":"10.1109\/ACCESS.2018.2886356","article-title":"The Devil is in the Detail: SDP-Driven Malformed Message Attacks and Mitigation in SIP Ecosystems","volume":"7","author":"Tsiatsikas","year":"2019","journal-title":"IEEE Access"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Rozhon, J., Gresak, E., and Jalowiczor, J. (2018, January 20\u201321). Using LSTM Cells for SIP Dialogs Mapping and Security Analysis. Proceedings of the 2018 26th Telecommunications Forum (TELFOR), Belgrade, Serbia.","DOI":"10.1109\/TELFOR.2018.8612019"},{"key":"ref_25","unstructured":"Salton, G., and Michael, J. (1986). Introduction to Modern Information Retrieval, McGraw-Hill."},{"key":"ref_26","unstructured":"Mikolov, T., Yih, W.t., and Zweig, G. (2013, January 9\u201314). Linguistic regularities in continuous space word representations. Proceedings of the 2013 Conference of the North American Chapter Of the Association for Computational Linguistics: Human Language Technologies, Atlanta, GA, USA."},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Pennington, J., Socher, R., and Manning, C.D. (2014, January 25\u201329). Glove: Global vectors for word representation. Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP), Doha, Qatar.","DOI":"10.3115\/v1\/D14-1162"},{"key":"ref_28","unstructured":"Abadi, M., Barham, P., Chen, J., Chen, Z., Davis, A., Dean, J., Devin, M., Ghemawat, S., Irving, G., and Isard, M. (2016, January 2\u20134). Tensorflow: A system for large-scale machine learning. Proceedings of the 12th USENIX Symposium on Operating Systems Design and Implementation, Savannah, GA, USA."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"179","DOI":"10.1207\/s15516709cog1402_1","article-title":"Finding structure in time","volume":"14","author":"Elman","year":"1990","journal-title":"Cognitive Sci."},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"2673","DOI":"10.1109\/78.650093","article-title":"Bidirectional recurrent neural networks","volume":"45","author":"Schuster","year":"1997","journal-title":"IEEE Trans. Signal Process."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Graves, A., Jaitly, N., and Mohamed, A.R. (2013, January 8\u201312). Hybrid speech recognition with deep bidirectional LSTM. Proceedings of the 2013 IEEE workshop on Automatic Speech Recognition And Understanding, Olomouc, Czech Republic.","DOI":"10.1109\/ASRU.2013.6707742"},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"602","DOI":"10.1016\/j.neunet.2005.06.042","article-title":"Framewise phoneme classification with bidirectional LSTM and other neural network architectures","volume":"18","author":"Graves","year":"2005","journal-title":"Neural Netw."},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"1735","DOI":"10.1162\/neco.1997.9.8.1735","article-title":"Long short-term memory","volume":"9","author":"Hochreiter","year":"1997","journal-title":"Neural Comput."},{"key":"ref_34","unstructured":"Chung, J., Gulcehre, C., Cho, K., and Bengio, Y. (2014). Empirical evaluation of gated recurrent neural networks on sequence modeling. arXiv."},{"key":"ref_35","first-page":"1929","article-title":"Dropout: A simple way to prevent neural networks from overfitting","volume":"15","author":"Srivastava","year":"2014","journal-title":"J. Mach. Learn. Res."},{"key":"ref_36","unstructured":"Nair, V., and Hinton, G.E. (2020, October 14). Rectified Linear Units Improve Restricted Boltzmann Machines. Available online: https:\/\/www.cs.toronto.edu\/~fritz\/absps\/reluICML.pdf."},{"key":"ref_37","unstructured":"Collier, M., and Endler, D. (2013). Hacking Exposed Unified Communications & VoIP Security Secrets & Solutions, McGraw-Hill Osborne Media."},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"4436","DOI":"10.1002\/sec.1328","article-title":"A comprehensive study of flooding attack consequences and countermeasures in session initiation protocol (sip)","volume":"8","author":"Hussain","year":"2015","journal-title":"Secur. Commun. Netw."},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Stanek, J., and Kencl, L. (August, January 31). SIPp-DD: SIP DDoS flood-attack simulation tool. Proceedings of the 2011 Proceedings of 20th International Conference on Computer Communications and Networks (ICCCN), Maui, HI, USA.","DOI":"10.1109\/ICCCN.2011.6005946"},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"467","DOI":"10.1109\/TNSM.2015.2459603","article-title":"Mitigating Mimicry Attacks against the Session Initiation Protocol","volume":"12","author":"Marchal","year":"2015","journal-title":"IEEE Trans. Netw. Serv. Mana."},{"key":"ref_41","first-page":"2825","article-title":"Scikit-learn: Machine learning in Python","volume":"12","author":"Pedregosa","year":"2011","journal-title":"J. Mach. Learn. Res."},{"key":"ref_42","doi-asserted-by":"crossref","unstructured":"Fern\u00e1ndez, A., Garc\u00eda, S., Galar, M., Prati, R.C., Krawczyk, B., and Herrera, F. (2018). Learning from Imbalanced Data Sets, Springer.","DOI":"10.1007\/978-3-319-98074-4"},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"He, H., and Ma, Y. (2013). Imbalanced Learning: Foundations, Algorithms, and Applications, John Wiley & Sons.","DOI":"10.1002\/9781118646106"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/20\/20\/5875\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T10:23:06Z","timestamp":1760178186000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/20\/20\/5875"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,10,17]]},"references-count":43,"journal-issue":{"issue":"20","published-online":{"date-parts":[[2020,10]]}},"alternative-id":["s20205875"],"URL":"https:\/\/doi.org\/10.3390\/s20205875","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2020,10,17]]}}}