一种新的SIP泛洪攻击检测方法

IMS(IP multimedia subsystem,IP多媒体子系统)是3G系统中核心网的重要部分,它由SIP提供的会话发起能力建立端到端的会话,并获得所需要的服务质量。针对IMS网络中存在的SIP泛洪攻击,本文在详细分析SIP泛洪攻击原理和实现过程的基础上,提出了一种基于累积和算法的SIP泛洪攻击检测方法。该方法首先对接收到的SIP数据分组中的invite消息的数量进行统计,然后将统计结果输入累积和算法,以检测是否发生SIP消息泛洪攻击,最后通过设置的阈值判决检测结果。实验结果表明,本文提出的方法能够有效地检测IMS网络中的SIP泛洪攻击。

An Approach for Detecting SIP Flooding Attacks in IMS Network

IMS(IP Multimedia Subsystem) is an important part of 3G system core network,and it uses SIP protocol to initiate session for end-to-end connection establishment,and then gains service quality requirement.Due to the existing of SIP flooding attack in IMS network,this paper detailedly analyzes SIP flooding attack principle and realization process,and proposes a SIP flooding attack detection approach based on cumulative sum algorithm.The approach firstly calculates the number of invite messages from SIP data packages,and then make the number of invite messages as an input to invoke cumulative sum algorithm to detect whether an attack happens,and finally,by setting a threshold value to decide all detection results.Experimental results demonstrate that the proposed approach can detect SIP flooding attack of IMS network effectively.