Theft of service architectural integrity validation tools for session initiation protocol (SIP)-based systems

1. A method comprising:

providing intrusion detecting protection for a Session Initiation Protocol (SIP)-based device, wherein providing intrusion detecting protection comprises:

parsing message logs received by the SIP-based device, wherein the parsing includes extracting Internet Protocol (IP) addresses from the message logs, creating a geographical profile based on the IP addresses, and performing a location analysis based on the IP addresses; and

identifying a call source as an unsolicited marketing attempt based on the parsed message logs.

2. The method of claim 1 , further comprising providing identity assurance protection for the SIP-based device including:

performing password cracking for the SIP-based device; and

eliminating spoofed traffic received by the SIP-based device.

3. The method of claim 1 , further comprising providing identity assurance protection for the SIP-based device including:

determining supported protocols for the SIP-based device; and

verifying support for one or more identity assurance mechanisms.

4. The method of claim 1 , further comprising providing identity assurance protection for the SIP-based device including:

eliminating unauthenticated INVITE messages received by the SIP-based device; and

identifying minimum cryptographic strength for transport layer security (TLS).

5. The method of claim 1 , further comprising providing multiple end-points protection for the SIP-based device including:

verifying if the SIP-based device permits a single user account to create multiple simultaneous calls; and

enforcing a threshold on a number of calls that may be generated from an account associated with the single user account.

6. The method of claim 5 , wherein providing multiple end-points protection further comprises:

calculating the threshold from usage history of the single user account.

7. The method of claim 1 , further comprising providing multiple end-points protection for the SIP-based device including:

enforcing a threshold on a number of registrations that may be performed in a time frame from a user account; and

blocking unauthorized registration attempts with the SIP-based device when the number of registrations exceeds the threshold.

8. The method of claim 1 , wherein providing intrusion detecting protection comprises:

determining if an anomaly exists in a usage pattern of the SIP-based device; and

alerting a security event management system when the anomaly exists.

9. The method of claim 1 , wherein providing intrusion detecting protection comprises:

optimizing filters to detect theft of service attacks on the SIP-based device; and

eliminating method vulnerabilities of the SIP-based device using behavioral-based techniques or knowledge-based techniques.

10. The method of claim 1 , further comprising:

providing identity assurance protection for the SIP-based device; and

providing multiple end-points protection for the SIP-based device.

11. The method of claim 1 , wherein providing intrusion detecting protection includes blocking SIP requests forwarded from a SIP proxy that is not an outbound proxy when the SIP request does not include an address in a home domain.

12. A system comprising:

one or more devices including:

a receiver to receive Session Initiation Protocol (SIP) messages in a SIP-based device;

a memory to store the SIP messages in message logs;

a processor to parse the message logs received by the SIP-based device, extract Internet Protocol (IP) addresses from the message logs, perform a location analysis based on the IP addresses, and identify a call source as an unsolicited marketing attempt based on the parsed message.

13. The system of claim 12 , wherein the processor is configured to

perform password cracking for the SIP-based device; and

eliminate spoofed traffic received by the SIP-based device.

14. The system of claim 12 , wherein the processor is configured to identity assurance protection mechanism:

determine supported protocols for the SIP-based device; and

verify support for one or more of a digest authentication mechanism, a transport layer security (TLS) mechanism, or a secure/multipurpose Internet mail extensions (S/MIME) mechanism.

15. The system of claim 12 , wherein the processor is configured to:

eliminate unauthenticated INVITE messages received by the SIP-based device; and

identify minimum cryptographic strength for transport layer security (TLS).

16. The system of claim 12 , wherein the processor is configured to:

verify if the SIP-based device permits a single user account to create multiple simultaneous calls; and

enforce a threshold on a number of calls that may be generated from the single user account.

17. The system of claim 16 , wherein the processor is configured to:

calculate the threshold from usage history of the single user account.

18. The system of claim 12 , wherein the processor is configured to:

enforce a threshold on a number of registrations that may be performed in a time frame from a user account; and

block unauthorized registration attempts with the SIP-based device when the number of registrations exceeds the threshold.

19. The system of claim 12 , wherein the processor is configured to:

determine if an anomaly exists in a usage pattern of the SIP-based device; and

alert a security event management system when the anomaly exists.

20. The system of claim 12 , wherein the processor is configured to:

optimize filters to detect theft of service attacks on the SIP-based device; and

eliminate method vulnerabilities of the SIP-based device using behavioral-based techniques or knowledge-based techniques.

21. The system of claim 12 , wherein the one or more devices are configured to prevent theft of service attacks on the SIP-based device using an identity assurance protection mechanism, a multiple end-points protection mechanism, and an intrusion detecting protection mechanism.

22. The system of claim 12 , wherein the processor is configured to SIP requests forwarded from a SIP proxy that is not an outbound proxy when the SIP request does not include an address in a home domain.

23. A system comprising:

one or more devices configured to:

validate, with test environment data, mechanisms that prevent theft of service attacks on a Session Initiation Protocol (SIP)-based device,

train the theft of service prevention mechanisms with real environment data,

compare results of the validation and the training, and

generate a measure of detection performance for the theft of service prevention mechanisms based on the comparison.

24. The system of claim 23 , wherein the theft of service prevention mechanisms include one or more of identity assurance protection mechanisms, multiple end-points protection mechanisms, or intrusion detecting protection mechanisms.

25. The system of claim 23 , wherein the one or more devices comprise:

a voice over Internet Protocol (VoIP) test bed of SIP-based devices; and

one or more SIP servers.