Development of a Distributed VoIP Honeypot System with Advanced Malicious Traffic Detection

The number of active users using Voice over IP (VoIP) services has an increasing tendency. With an expanding number of users, there is also a rapid increase in the number of hackers interested in attacking the VoIP communication system. This paper aims at detecting malicious SIP traffic and also deals with the security of the VoIP architecture issue. It is not a trivial matter to secure the VoIP system because exploiting the vulnerabilities of IP based telecommunication systems have increased. It is crucial to develop a tool that would be able to detect these attacks, analyse collected data, monitor attackers progress and to prepare an effective way of how to defend against VoIP attackers. That was the primary motivation why we have decided to develop our honeypot solution which can detect attacks on VoIP infrastructure, and it is adapted to the new security threats and which is designed according to the needs of the telecommunications market. Our VoIP honeypot is implemented purely in JAVA programming language and is capable of capturing and processing various types of attacks. The whole project is based on a Linux distribution, ready for the easiest deployment because it is prepared as a virtual machine image.