Abstract:

IMS（IP Multimedia Subsystem）is an important part of 3G system core network, and it uses SIP protocol to initiate session for end-to-end connection establishment, and then gains service quality requirement. Due to the existing of SIP flooding attack in IMS network, this paper detailedly analyzes SIP flooding attack principle and realization process, and proposes a SIP flooding attack detection approach based on cumulative sum algorithm. The approach firstly calculates the number of invite messages from SIP data packages, and then make the number of invite messages as an input to invoke cumulative sum algorithm to detect whether an attack happens, and finally, by setting a threshold value to decide all detection results. Experimental results demonstrate that the proposed approach can detect SIP flooding attack of IMS network effectively.

Key words: IMS network, SIP, flooding attack, invite message, cumulative sum