Detecting Abnormal SIP (Session Initiation Protocol) Traffic using Statistical Distribution Estimation
Joon Heo · Jeongbo gwahaghoe nonmunji. so'peuteuweeo mich eung'yong · 2011
The key protocol for a regular IP telephony service is the session initiation protocol (SIP), which is used as the basic signalling protocol. Flooding-type attacks that use SIP messages and target the proxy server or user agent can cause a denial-of-service status. In this paper, I present an abnormal SIP traffic detection scheme using statistical distribution estimation. I adopt the Mahalanobis distance scheme to decide outlier range of each SIP REQUEST message; it is standard metric for comparing two statistical distributions and is very useful for measuring similarity. Then, I compare the accumulation ratio of the callers and messages and finally detect abnormality. The proposed analysis process can observe not only traffic change but also detect abnormality of each type of SIP REQUEST message. I describe our approach and present experimental results in this paper.