融合网络中电信业务DoS攻击的分析与防御

doi:10.3969/j.issn.1000-0801.2010.08.010

摘要/Abstract

摘要：

市场对业务的需求促进了现代电信网从传统语音网络向基于IP 分组传输的下一代网络演进，IP网络缺乏QoS保证的缺点日益突出，以IP为承载的电信业务面临潜在DoS攻击的威胁，其攻击结果轻则降低用户接通率，严重时可完全阻断电信业务服务。本文首先剖析了融合网络环境下针对电信业务进行DoS攻击的原理及特点，比较了其与传统网络DoS攻击的不同，提出了有效的电信业务DoS攻击检测方法和防御DoS攻击模型。

关键词: 融合网络, 电信业务, DoS攻击, 信令消息

Abstract:

The increasingly demand of service gives rise to the modern telecommunication network's evolution from traditional voice network to the NGN based on IP packet transmission. The shortcoming that original IP network lacks QoS（quality of service）warranty becomes increasingly critical. The telecom IP services face a great threat of DoS, which will bring down call completion rate even cut off the services. This paper analyzes the principle and main characteristics of DoS attack to the telecom IP services under the environment of converged network, compares the differences between the new attack and traditional DoS attack, and proposes an effective detect method and defense DoS attack model. This model provides effective guarantee for the telecom IP service.

Key words: converged network, teleservice, DoS, signaling message

孙健,梁好,许都. 融合网络中电信业务DoS攻击的分析与防御[J]. 电信科学, 2010, 26(8): 46-52.

Jian Sun,Hao Liang,Du Xu. Analysis of DoS Attacks Aiming at Teleservices in Converged Networks and A Defense Measure[J]. Telecommunications Science, 2010, 26(8): 46-52.

图/表 4

参考文献 22

1	Hemant Sengar , Ram Dantu , et al. SS7 over IP: signaling interworking vulnerabilities. IEEE Network, 2006,20（6）: 32～41.
2	Hemant Sengar . Securing VoIP and PSTN from integrated signaling network vulnerabilities. VoIP Management and Security.In:1st IEEE Workshop on Vancouver , Canada, Piscataway, New Jersey, USA 2006
3	The voice over IP security alliance VOIPSA . VoIP Security and Privacy Threat Taxonomy-Public Release 1.0 ， October2006
4	Al-Allouni H , Rohiem A E , Hashem M , El-moghazy , et al. VoIP denial of service attacks classification and implementation In:Radio Science Conference, 2009
5	Bremler-Barr A , Halachmi-Beke R , Kangasharju J , Unregister attacks in SIP 2nd IEEE Workshop on Secure Network Protocols, 2006
6	Thomas Karagiannis , Roido A , Aloutsos M , et al. Transport layer identification of P2P traffic In: Proceedings of the 2004 ACM SIGCOMM Internet Measurement Conference, Taormina, Italy, 2004
7	Thomas T . Signaling system 7（SS7）network security In:Proceedings of the IEEE 45th Midwest Symposium on Circuits and Systems, Aug2004
8	Sengar H , Wijesekera D , Jajodia S . MTPSec: customizable secure MTP3 tunnels in the SS7 network In: Proceedings of the 19th IEEE Internationl Parallel and Distributed Processing Symposium,Colorado,, 2005
9	黄瑛 . 电信网络安全现状浅析. 现代商业, 2009(24): 232～232
10	傅华，杨义先 . 七号信令网上的攻击与防范. 信息网络安全, 2003（3）: 48～50
11	Hemant Sengar , Haining Wang , etal. Detecting VoIP floods using the hellinger distance. IEEE Transactions on Parallel and Distributed Systems, 2008,19（6）
12	Muhammad Sher , Thomas Magedanz . Protecting IP multimedia subsystem（IMS）service delivery platform from time independent attacks. In:Information Assurance and Security, Third International Symposium, Aug2008
13	Walsh T J , Kuhn D R . Challenges in securing voice over IP. In IEEE Security ＆ Privacy, June2005
14	傅华，李志蜀，袁小玲 . 分布式拒绝服务攻击及防范研究. 计算机应用研究， 2006,23（8）: 136～151
15	Savage S , Wetherall D , Karlin A . Network support for IP traceback. IEEE/ACM Transactions on Networking， 2001,9（3）: 226～237
16	Feinstein L , Schnackenberg D , Balupari R , et al. Statistical approaches to DDoS attack detection and reponse. In:Proceedings of the DARPA Information Survivability Conference and Exposition, Washington 2003
17	Mirkovic J , Prier G , Reiher P L . Attacking DDoS at the source. In:Proceedings of the 10th IEEE International Conference on Network Protocols, Paris 2002
18	Cabrera J B D , Lewis L , Qin X , et al. Proactive detection of distributed denial of service attacks using MIB traffic variables a feasibility study. In: Proceeding of the IEEE/IFIP International Symposium on Integrated Network Management, Seattle, WA, USA, 2001
19	Bolotin V A . Telephone circuit holding time distributions. In:Proceeding of 14th Int Teletraffic Cong, Antibes, France, North-Holland 1994
20	Barcel O F , Jord A N J . Channel holding time distribution in public telephony system（PAMR and PCS） IEEE Trans On vehicular Technology, 2000,49（5）
21	Jedrzycki C C , Leung V C M . Probaility distribution of channel holding time in cellular telephony systems. In:IEEE Vehicular Technology Conference VTC'96, 1996
22	Jin Cao , Cleveland W S , Yuan Gao , et al. Stochastic models for generating synthetic HTTP source traffic. In: Proceedings of IEEE INFOCOM, Hong Kong, China, March2001

协议类型		需采集的消息类型
ISUP	IAM	ANM	ACM	REL
H.323	setup	connect	alert	release
SIP	invite	ringing	ok	bye

[1]	孙耀华, 彭木根. 面向手机直连的低轨卫星通信：关键技术、发展现状与未来展望[J]. 电信科学, 2023, 39(2): 25-36.
[2]	袁硕, 任奕璟, 王则予, 孙耀华, 彭木根. 软件定义的星地融合智能无线网络[J]. 电信科学, 2021, 37(6): 66-77.
[3]	郑小平,华楠. 光网络30年：回顾与展望[J]. 电信科学, 2016, 32(5): 24-33.
[4]	陈赓,姚文静,郭银景,夏玮玮. 同频异构femtocell联合子信道和功率分配算法[J]. 电信科学, 2015, 31(9): 20-27.
[5]	罗志强,沈军,金华敏. 分布式DNS反射DDoS攻击检测及控制技术[J]. 电信科学, 2015, 31(10): 1-196.
[6]	杜涛. 用互联网的产品精神盘活电信传统业务——电信传统业务的互联网开放研究与实践[J]. 电信科学, 2014, 30(Z1): 78-81.
[7]	胡晓艳,龚俭. 信息中心网络中网络缓存的角色探索[J]. 电信科学, 2014, 30(3): 67-74.
[8]	欧亮,阮科,朱永庆,邹洁. 超宽带网络环境下的一体化自助指配技术研究[J]. 电信科学, 2012, 28(1): 17-21.
[9]	欧亮,阮科,朱永庆,邹洁. 超宽带网络环境下的一体化自助指配技术研究[J]. 电信科学, 2012, 28(1): 21-25.
[10]	杨松,李宗林. 一种DDoS攻击的检测算法[J]. 电信科学, 2010, 26(9): 106-110.
[11]	仝建刚,彭昭,周洲,吴江. 云计算在电信运营商中的应用研究[J]. 电信科学, 2010, 26(8A): 28-32.
[12]	张廷权,王伊娜. 圈子口碑如何助力电信产品营销[J]. 电信科学, 2009, 25(11): 4-7.