On Vulnerability Testing of VoIP Software - The MEGACO/H.248 System as an Example

The ever increasing quantity of newly discovered computer security holes makes many network-based service including especially Voice over IP (VoIP) system vulnerable, hence impose a heavy impact on business development. Megaco or H.248 is a recent emerging VoIP protocol which will promote carriers to move into VoIP applications. In this paper, we present the vulnerability testing of Megaco protocol, with a focus on the mutation-based syntax testing approach. We discuss the process of vulnerability test suite generation for Megaco, which is based on parameter variation and a TTCN-3 based framework. The result of a demonstrated testing of a commercial Megaco product is also presented