Apparatus and method for detecting SIP message flooding attack based on CUSUM algorithm

Abstract

The invention relates to a device and a method for detecting SIP message flood attacking based on a CUSUM algorithm, wherein the device is formed by a multifunction module formed by a gathering layer, a data layer, a detecting layer and a response layer, wherein a bale grabber module of the gathering layer gathers an SIP data packet in network, a module of the data layer preprocesses the SIP data packet from the gathering layer, and respectively stores the grabbed total amount of INVITE messages and REGISTER messages, a CUSUM module of the detecting layer adopts a CUSUM algorithm to correct INVITE message value and REGISTER message value, which are stored to detect and output detection results. An alarm module of the response layer judges whether the detection result gives alarm or not to the detection result, if the detection result exceeds a preset threshold value, SIP information flood attacking is regarded to come across, and alarm signals are sent out, if not, network is represented to be normal. The device and the method are simple and practical, which are easily achieved, and can effectively detect out flood attacking aiming at SIP information in NGN network.

Description

technical field [0001] The invention relates to a method for ensuring the safe transmission of network information, specifically, a device and method for detecting flood attacks of SIP messages (including INVITE messages and REGISTER messages) based on a CUSUM algorithm, and belongs to the technical field of network information security. . Background technique [0002] NGN (Next Generation Network) uses Session Initiation Protocol (SIP) to create, manage and terminate multimedia services of various types of messages through a session control mechanism. NGN is a milestone in the history of telecommunication, marking the coming of a new generation of telecommunication network era. With the rapid popularization of computer networks and the continuous rise of various new services in telecommunication networks, network security issues have gradually penetrated into various fields of social life and become more and more serious. Because NGN has the characteristics of network IP ...

AI Technical Summary

Problems solved by technology

However, up to now, the use of CUSUM method in China to detect flooding attacks has only stayed at the stage of TCP messages, and the research results of detection and defense methods for flooding attacks of SIP messages are almost blank; the main reason is that operators currently NGN has not been brought to market

[0005] Therefore, the current telecom operators and management departments are eager to use NGN network to provide carrier-class services, but the security problems in the future will obviously slow down this trend

Images