System and method for integrated header, state, rate and content anomaly prevention for session initiation protocol

A method comprising:

• receiving, by a packet interface of a denial of service (DoS) attack mitigation appliance associated with a private network, inbound/outbound packets;
• and
• protecting, by the DoS attack mitigation appliance, a Session Initiation Protocol (IP) server within the private network from being flooded by:
• classifying, by a Session Initiation Protocol (SIP) classifier of the DoS attack mitigation appliance, SIP packets of the inbound/outbound packets as either SIP requests or SIP responses;
• classifying, by a SIP header classifier of the DoS attack mitigation appliance, various components of SIP protocol headers of the SIP requests and the SIP responses;
• identifying, by a per source flood checking module of the DoS attack mitigation appliance, a particular source Internet Protocol (IP) as an attacker by detecting SIP requests from the particular source Internet Protocol (IP) address exceeding a predetermined request threshold;
• identifying, by a method floods module of the DoS attack mitigation appliance, one or more SIP methods under attack by tracking a plurality of individual types of SIP requests observed and for each type of SIP request of the plurality of individual types of SIP requests comparing a number of SIP requests received of the type of SIP request with a corresponding predetermined threshold;
• identifying, by a SIP user-agent (UA) flood module of the DoS attack mitigation appliance, occurrence of a SIP UA flood by comparing a number of UA headers in INVITE requests of the SIP requests to a predetermined UA threshold;
• identifying, by a SIP Uniform Resource Identifier (URI) flood module of the DoS attack mitigation appliance, occurrence of a SIP URI flood by comparing a number of SIP URIs in the INVITE requests to a predetermined URI threshold;
• and
• during a period in which a particular SIP method is identified as being under attack, dropping, by the DoS attack mitigation appliance, subsequent SIP requests originated by the particular source IP address;
• during a period in which the occurrence of a SIP UA flood has been identified, dropping, by the DoS attack mitigation appliance, subsequent INVITE requests originated by the particular source IP address;
• and
• during a period in which the occurrence of a SIP URI flood has been identified, dropping, by the DoS attack mitigation appliance, subsequent INVITE requests originated by the particular source IP address.