System and method for testing network firewall for denial-of-service (DOS) detection and prevention in signaling channel

A computer-implemented method comprising:

• measuring, by a processor, a first performance, associated with non-attack traffic without attack traffic, of a Session Initiation Protocol (SIP)-based protection device implementing rate-limiting (RL) filtering of SIP request or response messages, wherein implementing the RL filtering includes limiting the number of SIP request or response messages to a particular rate;
• measuring, by the processor, a second performance, associated with non-attack traffic and attack traffic, of the SIP-based protection device implementing RI, filtering of SIP request or response messages, wherein the attack traffic includes at least one of a flood of out-of-state SIP request messages, or a flood of out-of-state responses to a SIP request message;
• and
• measuring, by the processor, a third performance, associated with non-attack traffic without attack traffic, of the SIP-based protection device not implementing Rh filtering of SIP request or response messages.

A computer-implemented method comprising:

• sending, by a transmitter, a known amount of attack traffic to a Session Initiation Protocol (SIP)-based protection device implementing one or more of return mutability (RR) filtering of SIP request messages or rate-limiting (RL) filtering of SIP request or response messages, wherein implementing the RL filtering includes limiting the number of SIP request or response messages to a particular rate, and wherein implementing the RR filtering includes blocking SIP request messages including source addresses that are not authenticated, wherein an authenticated source address is a source address in a SIP request message known not to be spoofed;
• increasing an amount of non-attack traffic, being sent by the transmitter, until a SIP proxy associated with the SIP-based protection device cannot establish additional sessions as a result of the SIP proxy becoming overloaded;
• and
• increasing the known amount of attack traffic, being sent by the transmitter, to the SIP-based protection device and repeating increasing the amount of non-attack traffic until the SIP proxy cannot establish additional sessions as a result of the SIP proxy becoming overloaded.

A system comprising:

• one or more network devices for sending non-attack traffic to a Session Initiation Protocol (SIP)-based protection device, wherein the SIP-based protection device implements one or more of return routability (RR) filtering of SIP request messages or rate-limiting (RE) filtering of SIP request or response messages, wherein implementing the RL filtering includes limiting the number of SIP request or response messages to a particular rate, and wherein implementing the RR filtering includes blocking SIP request messages including source addresses that are not authenticated, wherein an authenticated source address is a source address in a SIP request message known not to be spoofed;
• one or more transmitters for sending attack traffic to the SIP-based protection device, wherein the attack traffic includes one or more of spoofed SIP request messages, or a flood of out-of-state SIP messages;
• and
• a controller including a processor for measuring the non-attack traffic and the attack traffic when a SIP proxy associated with the SIP-based protection device cannot establish additional sessions as a result of the attack traffic and the non-attack traffic overloading the SIP proxy.