电信科学 ›› 2011, Vol. 27 ›› Issue (12): 48-52.doi: 10.3969/j.issn.1000-0801.2011.12.014

• 研究与开发 • 上一篇    下一篇

一种新的SIP泛洪攻击检测方法

常国锋1,焦大军1,孙悦2   

  1. 1 新乡学院 新乡453003
    2 北京邮电大学网络与交换技术国家重点实验室 北京 100876
  • 出版日期:2011-12-15 发布日期:2011-12-15
  • 基金资助:
    国家“863”计划基金资助项目;国家教育部科学技术研究重点资助项目;河南省教育厅自然科学研究计划科技攻关基金资助项目

An Approach for Detecting SIP Flooding Attacks in IMS Network

Guofeng Chang1,Dajun Jiao1,Yue Sun2   

  1. 1 Xinxiang College, Xinxiang 453003, Chin
    2 State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing 100876, China
  • Online:2011-12-15 Published:2011-12-15

在线阅读

8

PDF下载

569

摘要：

IMS（IP multimedia subsystem,IP 多媒体子系统）是3G 系统中核心网的重要部分，它由 SIP 提供的会话发起能力建立端到端的会话，并获得所需要的服务质量。针对 IMS 网络中存在的 SIP 泛洪攻击，本文在详细分析SIP 泛洪攻击原理和实现过程的基础上，提出了一种基于累积和算法的 SIP泛洪攻击检测方法。该方法首先对接收到的SIP 数据分组中的invite 消息的数量进行统计，然后将统计结果输入累积和算法，以检测是否发生 SIP 消息泛洪攻击，最后通过设置的阈值判决检测结果。实验结果表明，本文提出的方法能够有效地检测IMS 网络中的SIP 泛洪攻击。

关键词: IMS网络, SIP, 泛洪攻击, invite消息, 累积和算法

Abstract:

IMS（IP Multimedia Subsystem）is an important part of 3G system core network, and it uses SIP protocol to initiate session for end-to-end connection establishment, and then gains service quality requirement. Due to the existing of SIP flooding attack in IMS network, this paper detailedly analyzes SIP flooding attack principle and realization process, and proposes a SIP flooding attack detection approach based on cumulative sum algorithm. The approach firstly calculates the number of invite messages from SIP data packages, and then make the number of invite messages as an input to invoke cumulative sum algorithm to detect whether an attack happens, and finally, by setting a threshold value to decide all detection results. Experimental results demonstrate that the proposed approach can detect SIP flooding attack of IMS network effectively.

Key words: IMS network, SIP, flooding attack, invite message, cumulative sum

No Suggested Reading articles found!