ty caused to these auxiliary systems, e.g., parser, DNS lookup service etc., affects all underlying SIP services, turning them unavailable as well. Focus on the identification of flooding attacks that exploit INVITE mes- sages against SIP proxies is given by the work presented elsewhere [33-37]. Reynolds and Ghosal [33] introduce an application layer attack sensor, based on the cumulative sum method [38] and the correlation between SIP INVITE and "200 OK" response messages, in order to detect a flooding attack. Another interesting approach for detecting flooding attacks is described by Sengar et al. [34]. This time the detection method is based on the correlation of SIP INVITE, "200 OK" response and SIP BYE (or SIP CANCEL) messages, and the Hellinger distance among them. Two slightly different approaches, based on the original finite-state machine for SIP transactions, are presented [35]. Finally, Fiedler et al. [37] present a scalable SIP-based security architecture, known as VoIP defender, capable of processing more than 50.000 SIP requests per second is introduced. This is the only architecture that takes into account performance requirements as well. Table 18.3 highlights the security requirements fulfilled by each of the secu- rity mechanisms described above. It is stressed that none of these mechanisms can assure a complete end-to-end security and thus they must be employed in conjunction with existing SIP security mechanisms. 18.6 Conclusions This chapter has presented and analyzed security issues of the SIP. It has been demonstrated that it is crucial for SIP service providers to take into serious C 2009 by Taylor & Francis Group, LLC SIP Security: Threats, Vulnerabilities and Countermeasures consideration the emerging and highly sophisticated SIP-oriented threats and vulnerabilities that could be exploited by malicious users to launch an attack. In order to eliminate such threats it is very important to identify the actual sec- urity requirements and fulfill them through the appropriate security measures