KR101177049B1 - System for detecting abnormal VoIP traffic using heuristic statistic-information - Google Patents

Abstract

According to a systematic step, an abnormal VoIP traffic detection system based on heuristic statistics information for detecting abnormal SIP traffic on a VoIP network is provided. An abnormal VoIP traffic detection system includes: a receiving module receiving traffic information on a network, a detecting module receiving traffic information from a receiving module and analyzing the traffic to detect whether there is a SIP DDoS attack, a SIP SCAN attack, or an RTP DDoS attack on the network; And a statistics DB providing a number of reference values for the detection module to analyze the traffic, wherein detecting the SIP DDoS attack traffic includes conducting behavior-based analysis and heuristic SIP pattern variation analysis of traffic on the network to perform potential SIP DDoS Detecting attack traffic and analyzing request method and response method for potential SIP DDoS attack traffic to detect potential SIP DDoS attack traffic as SIP DDoS attack traffic.

Description

System for detecting abnormal VoIP traffic using heuristic statistic-information}

The present invention relates to a heuristic statistical information based abnormal VoIP traffic detection system.

Conventional techniques related to an abnormal traffic detection system on a network analyze IP characteristics using only 5-tuple information (source IP, source port, destination IP, destination port, protocol (TCP, UDP, ICMP)) of IP traffic. And abnormal traffic was detected. However, in the case of SIP application service which is being exploded in recent years due to the development of Internet telephony, IP traffic monitoring technology and abnormal IP traffic detection technology can effectively monitor such SIP traffic or detect abnormal SIP traffic attack. There was no.

This is because, firstly, in case of SIP traffic, a URI, which is an identifier for providing an application service, is additionally used in addition to the IP and port information. This is because the conventional technology cannot properly monitor such a URI. Next, SIP performs call setup. Although the delivery path may be different even though SIP traffic for RTP and RTP traffic for media transmission are actually traffic inside the same application service session, existing IP traffic monitoring devices or IP-based security devices could not recognize and process them. .

Therefore, there is a need for a detection system capable of detecting abnormal SIP traffic (for example, DDoS attack traffic or SCAN attack traffic) on such a network according to systematic steps.

The technical problem to be solved by the present invention is to provide an abnormal VoIP traffic detection system that can detect abnormal SIP traffic on the VoIP network according to a systematic step.

Technical problems of the present invention are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art from the following description.

An aspect of the abnormal VoIP traffic detection system of the present invention for achieving the above technical problem is a receiving module for receiving traffic information on a network, receiving the traffic information from the receiving module and analyzing the traffic, SIP DDoS to the network A detection module that detects whether there is an attack, a SIP SCAN attack, or an RTP DDoS attack, and a statistics database that provides a number of thresholds for the detection module to analyze the traffic, wherein detecting the SIP DDoS attack traffic includes: Detect potential SIP DDoS attack traffic by conducting behavior-based analysis and heuristic SIP pattern variability analysis, and detect potential SIP DDoS attack traffic as SIP DDoS attack traffic by analyzing request methods and response methods for potential SIP DDoS attack traffic. It involves doing.

Specific details of other embodiments are included in the detailed description and the drawings.

The abnormal VoIP traffic detection system according to an embodiment of the present invention detects the DDoS attack traffic based on various information at the application level, thereby detecting the SIP DDoS attack traffic that cannot be detected at the IP level.

In addition, the abnormal VoIP traffic detection system according to an embodiment of the present invention detects potential SIP DDoS attack traffic by performing behavior-based analysis and heuristic SIP pattern variation analysis as described above, and applies to such potential SIP DDoS attack traffic. By analyzing the request method and response method, the potential SIP DDoS attack traffic is detected as SIP DDoS attack traffic. Therefore, according to the systematic steps, it is possible to detect abnormal SIP traffic on the VoIP network.

Lastly, since the detection reference value of the abnormal VoIP traffic detection system according to an embodiment of the present invention is updated in real time according to the traffic analysis result of the detection module, the abnormal SIP traffic is reflected to reflect the traffic situation that changes in real time. It is possible to detect.

Effects of the present invention are not limited to the above-mentioned effects, and other effects not mentioned will be clearly understood by those skilled in the art from the following description.

1 is a block diagram of an abnormal VoIP traffic detection system according to an embodiment of the present invention.
2 is an example of SIP traffic information received by a receiving module of an abnormal VoIP traffic detection system according to an embodiment of the present invention.
3 is a detailed example of behavior-based analysis items analyzed by a detection module of an abnormal VoIP traffic detection system according to an embodiment of the present invention.
4 is a flowchart illustrating an operation of a SIP DDoS detection module of an abnormal VoIP traffic detection system according to an embodiment of the present invention.
5 is a diagram illustrating a SIP DDoS attack traffic detection operation of the SIP DDoS detection module of an abnormal VoIP traffic detection system according to an embodiment of the present invention.
6 is a flowchart illustrating an operation of a SIP SCAN detection module of an abnormal VoIP traffic detection system according to an embodiment of the present invention.
7 is a flowchart illustrating the operation of the RTP DDoS detection module of the abnormal VoIP traffic detection system according to an embodiment of the present invention.
8 is a view for explaining the effect of the abnormal VoIP traffic detection system according to an embodiment of the present invention.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but will be implemented in various forms, and only the present embodiments are intended to complete the disclosure of the present invention, and the general knowledge in the art to which the present invention pertains. It is provided to fully convey the scope of the invention to those skilled in the art, and the present invention is defined only by the scope of the claims. The size and relative size of the components shown in the drawings may be exaggerated for clarity of explanation.

Like reference numerals refer to like elements throughout the specification, and "and / or" includes each and every combination of one or more of the mentioned items.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. In the present specification, the singular form includes plural forms unless otherwise specified in the specification. As used herein, the terms "comprises" and / or "made of" means that a component, step, operation, and / or element may be embodied in one or more other components, steps, operations, and / And does not exclude the presence or addition thereof.

Although the first, second, etc. are used to describe various components, it goes without saying that these components are not limited by these terms. These terms are used only to distinguish one component from another. Therefore, it goes without saying that the first component mentioned below may be the second component within the technical scope of the present invention.

Unless otherwise defined, all terms (including technical and scientific terms) used in the present specification may be used in a sense that can be commonly understood by those skilled in the art. Also, commonly used predefined terms are not ideally or excessively interpreted unless explicitly defined otherwise.

Hereinafter, an abnormal VoIP traffic detection system according to an embodiment of the present invention will be described with reference to FIGS. 1 to 7.

1 is a block diagram of an abnormal VoIP traffic detection system according to an embodiment of the present invention, Figure 2 is an example of SIP traffic information received by the receiving module of the abnormal VoIP traffic detection system according to an embodiment of the present invention .

First, referring to FIG. 1, an abnormal VoIP traffic detection system 100 according to an embodiment of the present invention includes a reception module 10, a detection module 40, a collection DB 80, a statistics DB 85, and a log. DB 90 may be included.

The receiving module 10 may be a module for receiving traffic information on a network. In an embodiment of the present invention, such a network may be a Voice over Internet Protocol (VoIP) network through which voice traffic is transmitted, and the traffic information received by the receiving module 10 from such a network is transmitted to SIP traffic as shown in FIG. Netfolw based SIP traffic information including information about the information and about the RTP traffic.

The traffic information received through the reception module 10 may be provided to the detection module 40 via the temporary queue 20 and the temporary DB 30. Although FIG. 1 illustrates that the traffic information is provided to the detection module 40 via the temporary queue 20 and the temporary DB 30 to increase the efficiency of traffic processing, the present invention is illustrated in FIG. It is not limited. That is, the temporary queue 20 and the temporary DB 30 may be omitted as necessary.

The detection module 40 may be a module that receives traffic information from the receiving module 10 and analyzes the traffic to detect whether there is a SIP DDoS attack, a SIP SCAN attack, or an RTP DDoS attack in the network. Specifically, the detection module 40 compares the traffic information of each item provided from the receiving module 10 with a reference value of each item provided by the statistics DB 85 to perform a SIP DDoS attack, a SIP SCAN attack, or an RTP DDoS attack on the network. It may be a module that detects the presence of a message. The detection module 40 includes a SIP DDoS attack detection module 50 for detecting a SIP DDoS attack, a SIP SCAN attack detection module 60 for detecting a SIP SCAN attack, and an RTP DDoS for detecting an RTP DDoS attack. Attack detection module 70 may be configured, and detailed operations of each module will be described later in detail.

On the other hand, the detection module 40 of the abnormal VoIP traffic detection system 100 according to an embodiment of the present invention performs the behavior-based analysis and / or heuristic SIP pattern variation analysis for the traffic on the provided network traffic traffic It can detect whether it is attack traffic. Specifically, the detection module 40 detects potential SIP DDoS attack traffic by performing behavior-based analysis and heuristic SIP pattern variation analysis step by step on the provided network traffic, and request method for detected potential SIP DDoS attack traffic. And response method may be analyzed to detect SIP DDoS attack traffic. In addition, the detection module 40 may detect the SIP SCAN attack traffic and the RTP DDoS attack traffic by performing behavior-based analysis on the provided traffic on the network.

Here, the behavior-based analysis may specifically include user distribution pattern analysis, call behavior pattern analysis, network state analysis, and the like. More specifically, the user distribution pattern analysis may include SIP address distribution analysis and SIP address-to-IP address association analysis, and call behavior pattern analysis may include request message transmission rate and rate analysis and call transaction rate analysis. The network state analysis may include SIP application traffic volume analysis and media traffic quality analysis. Detailed exemplary analysis items for each are summarized in FIG. 3.

3 is a detailed example of behavior-based analysis items analyzed by a detection module of an abnormal VoIP traffic detection system according to an embodiment of the present invention.

Referring to FIG. 3, an SIP address distribution analysis may mean a traffic from-to rate analysis, and a SIP address-IP address association analysis may mean a from-srcIP rate analysis. In addition, the request message transmission rate and rate analysis includes INVITE message transmission rate and rate analysis, REGISTER message transmission rate and rate analysis, BYE message transmission rate and rate analysis, CANCEL message transmission rate and rate analysis, and OPTION message transmission number. And rate analysis, MESSAGE message transfer and rate analysis, call transaction rate analysis may include INVITE message to 100Trying rate analysis, INVITE message to 200OK rate analysis, REGISTER message to 200OK rate analysis, and OPTION message to 200OK rate analysis and MESSAGE message to 200OK rate analysis. Finally, SIP application traffic volume analysis can include SIP bps analysis, RTP bps analysis, SIP bytes ratio analysis, RTP bytes ratio analysis, and RTP bytes to session ratio analysis. May mean analysis. For an example of the actual analysis method for each item, please refer to the explanation column shown in FIG. 3.

Meanwhile, the heuristic SIP pattern variation analysis may be performed on an item in which the analysis result is abnormally detected among the behavior-based analysis items described above. That is, the heuristic SIP pattern variation analysis may not be performed on all of the behavior-based analysis items, but may be performed by analyzing the recent variation of the items only for those items in which the behavior-based analysis result is abnormally detected. For example, if a behavior-based analysis of the traffic results in abnormality in the From-To ratio analysis item, the detection module 40 determines the From-To rate analysis item based on the recent variation of the From-To rate of the traffic to be analyzed. Heuristic SIP pattern variation analysis can be performed for.

As a result, the detection module 40 calculates a detection score based on the behavior-based analysis result and the heuristic SIP pattern variation analysis result, and detects the analysis target traffic as the attack traffic when the score is above a predetermined threshold. More specific criteria and detailed description thereof will be described later with the operation of the detection module 40 of the abnormal VoIP traffic detection system 100 according to an embodiment of the present invention.

Referring again to FIG. 1, the collection DB 80 may be a store that stores the traffic information analyzed and detected by the detection module 40, and the statistics DB 85 provides the traffic information from the collection DB 80. May be a repository that provides a number of reference values needed for detection module 40 to analyze the traffic. Here, each reference value provided to the detection module 40 by the statistics DB 85 of the abnormal VoIP traffic detection system 100 according to an embodiment of the present invention is determined according to the above-described traffic analysis result of the detection module 40. The value can be updated in real time. That is, each reference value provided by the statistics DB 85 to the detection module 40 may be a value that is updated as the traffic situation changes, that is, reflects the traffic situation in real time.

Finally, when the detection module 40 detects the traffic to be analyzed as the attack traffic, the log DB 90 may be a store that stores a log thereof.

4 to 8, the operation of the detection module 40 of the abnormal VoIP traffic detection system 100 according to an embodiment of the present invention will be described. First, the operation of the SIP DDoS attack detection module 50 will be described with reference to FIGS. 4 and 5.

4 is a flowchart illustrating an operation of a SIP DDoS detection module of an abnormal VoIP traffic detection system according to an embodiment of the present invention, and FIG. 5 is a SIP DDoS detection of an abnormal VoIP traffic detection system according to an embodiment of the present invention. A diagram illustrating the SIP DDoS attack traffic detection operation of the module.

Referring to FIG. 4, the reception module 10 receives netflow-based SIP traffic information (S100). Then, the traffic information received through the receiving module 10 is provided to the SIP DDoS attack detection module 50 via the temporary queue 20 and the temporary DB 30 (S102).

The SIP DDoS attack detection module 50 provided with the following traffic information groups them by destination IP (S104). Then, behavior-based analysis is performed for each group (S106 and S108).

Specifically, the SIP DDoS attack detection module 50 performs analysis on the items shown in Table 1 below for each group. That is, the traffic from-to rate, SIP bps, SIP bytes rate, SIP request message transmission rate and rate, and call transaction rate are compared with the reference values shown in Table 1. Here, the reference value may be a value provided from the statistics DB 85 as described above.

Analysis item Reference value Detection method From-To Ratio Same day over the past month Same time zone Average + (standard deviation * 2)
or,
Larger of user-specified fixed values Detects when a threshold is exceeded SIP bps SIP bytes rate SIP Request Message Transmissions and Rates Detects when the requested message is transmitted more than n times and the transmission rate exceeds the threshold Call transaction rate Detects when a threshold is exceeded

If there is an item exceeding the reference value among these, the item is given a detection score as shown in Table 2 below.

Analysis item From-To Ratio SIP bps SIP bytes rate SIP Request Message Transmissions and Rates Call transaction rate Detection score 2 4 3 2 2

That is, for example, if the traffic From-To ratio and the SIP bps exceed the reference value, the corresponding detection score 2 + 4 = 6 is assigned.

Next, referring back to FIG. 4, heuristic SIP pattern variation analysis is performed on items whose behavior-based analysis results are abnormally detected (S110 and S112).

In the previous example, if only the From-To ratio and the SIP bps of the traffic exceeded the reference value, the heuristic SIP pattern variation analysis is performed on the From-To ratio and the SIP bps of the traffic. This heuristic SIP pattern variation analysis is performed as follows.

First, T values calculated by Equation 1 below are calculated for each item.

&Quot; (1) "

T = S + E (where S is the mean of 30-second increments over the last N minutes, E is the standard deviation of the variance in 30-second increments over the last N minutes * 2)

If the item is larger than the calculated T value, the detection score shown in Table 2 for the item is multiplied by two.

That is, in the previous example, if the From-To ratio of the traffic and the From-To ratio of the SIP bps did not exceed the calculated T value, but the SIP bps exceeded the calculated T value, the detection score of the From-To ratio item would be As it is 2, the SIP bps entry's detection score is 4 times 8 times 2.

Next, referring back to FIG. 4, all the detection scores reflecting the weights are summed (S114). If the sum of the detection scores is equal to or greater than a predetermined threshold (eg, 10), the traffic to be analyzed is detected as potential SIP DDoS attack traffic (S116).

Earlier, in the example, the traffic from-to-rate detection score was 2, the SIP bps detection score was 8, the SIP bytes rate, the number and rate of SIP request message transmissions, and the call transaction rate were 0, so the sum is 10 Becomes Accordingly, the SIP DDoS attack detection module 50 detects the traffic to be analyzed as potential SIP DDoS attack traffic.

Next, it analyzes the request method and response method for the detected potential SIP DDoS attack traffic and detects whether it is SIP DDoS attack traffic (S118, S120). That is, the SIP DDoS attack detection module 50 may determine that the number of request methods is greater than zero in the potential SIP DDoS attack traffic when the ACK method is 0, or when the ratio of the number of response methods to the number of request methods exceeds 5, SIP DDoS attack traffic is detected as SIP DDoS attack traffic.

In general, if the traffic to be analyzed is SIP DDoS attack traffic, unlike in the normal situation illustrated in FIG. 5A, as shown in FIG. 5B, there is no ACK method in the traffic or a request method. The ratio of response methods to the response may be too high (for example, the number of response methods / the number of request methods> 5). Accordingly, the SIP DDoS attack detection module 50 detects the traffic to be analyzed as SIP DDoS attack traffic when there is no ACK method number of analysis traffic or the ratio of response methods to the request method exceeds 5.

Next, a tag (Tag) is attached to the traffic detected as SIP DDoS attack traffic (S122), and normal traffic stores them in the collection DB 80 without tagging (S200). In addition, the statistics DB 85 obtains only normal traffic information without tagging among the traffic information stored in the collection DB 80, and updates the reference values for the respective analysis items previously stored (S210 and S220).

Next, the operation of the SIP SCAN attack detection module 60 will be described with reference to FIG. 6.

6 is a flowchart illustrating an operation of a SIP SCAN detection module of an abnormal VoIP traffic detection system according to an embodiment of the present invention.

Referring to FIG. 6, the receiving module 10 receives netflow based SIP traffic information (S100). Then, the traffic information received through the receiving module 10 is provided to the SIP SCAN attack detection module 60 via the temporary queue 20 and the temporary DB 30 (S102).

Next, the SIP SCAN attack detection module 60 provided with the traffic information groups them by source IP (S130). Then, behavior-based analysis is performed for each group (S132, S134).

Specifically, the SIP SCAN attack detection module 60 performs an analysis on the items shown in Table 3 below for each group. This analysis method is similar to the SIP DDoS attack detection module 50 described above, and thus redundant description will be omitted.

Analysis item Reference value Detection method SIP bps Average of the callers' maximum for the last week plus + (standard deviation * 2)
or,
Larger of user-specified fixed values Detects when a threshold is exceeded SIP byte rate SIP Request Message Transmissions and Rates Detects when the requested message is transmitted more than n times and the transmission rate exceeds the threshold Call transaction rate Detects when a threshold is exceeded

If there is an item exceeding the reference value among these, the item is given a detection score as shown in Table 4 below.

Analysis item SIP bps SIP bytes rate SIP Request Message Transmissions and Rates Call transaction rate Detection score 5 4 8 6

Then, the detection scores for each item are added up (S136). If the sum of the detection scores is equal to or greater than a predetermined threshold (eg, 10), the traffic to be analyzed is detected as SIP SCAN attack traffic (S138).

Next, a tag (Tag) is attached to the traffic detected as SIP SCAN attack traffic (S140), and normal traffic stores them in the collection DB 80 without tagging (S200). In addition, the statistics DB 85 obtains only normal traffic information without tagging among the traffic information stored in the collection DB 80, and updates the reference values for the respective analysis items previously stored (S210 and S220).

Next, the operation of the RTP DDoS attack detection module 70 will be described with reference to FIG. 7.

7 is a flowchart illustrating the operation of the RTP DDoS detection module of the abnormal VoIP traffic detection system according to an embodiment of the present invention.

Referring to FIG. 7, the receiving module 10 receives netflow-based SIP traffic information (S100). Then, the traffic information received through the receiving module 10 is provided to the RTP DDoS attack detection module 70 via the temporary queue 20 and the temporary DB 30 (S102).

Next, the RTP DDoS attack detection module 70 provided with the traffic information groups them by source IP (S150). Then, behavior-based analysis is performed for each group (S152 and S154).

Specifically, the RTP DDoS attack detection module 70 performs analysis on the items shown in Table 5 below for each group. This analysis method is also similar to the SIP DDoS attack detection module 50 and the SIP SCAN attack detection module 60 described above, so the detailed description thereof will be omitted.

Analysis item Reference value Detection method RTP bps Same day over the past month Same time zone Average + (standard deviation * 2)
or,
Larger of user-specified fixed values Detects when a threshold is exceeded RTP byte rate MoS Custom fixed value Detect when below standard value

If there is an item (RTP bps, RTP byte ratio) that is greater than or equal to the reference value or an item (MoS) that is less than or equal to the reference value, a detection score as shown in Table 6 below is assigned to the item.

Analysis item RTP bps RTP bytes rate MoS Detection score 2 8 10

Then, the detection scores for each item are added up (S156). If the sum of the detection scores is equal to or greater than a predetermined threshold (eg, 10), the traffic to be analyzed is detected as potential RTP DDoS attack traffic (S158).

Next, if the detected potential RTP DDoS attack traffic has no matching SIP session matching, or if the value of (InBytes / OutBytes * 100) of the potential RTP DDoS attack traffic is greater than a certain value (e.g., k), then the potential RTP DDoS attack traffic is detected as RTP DDoS attack traffic (S1160, S162). Then, a tag (Tag) is attached to the traffic detected as RTP DDoS attack traffic (S164), and normal traffic stores them in the collection DB 80 without tagging (S200). In addition, the statistics DB 85 obtains only normal traffic information without tagging among the traffic information stored in the collection DB 80, and updates the reference values for the respective analysis items previously stored (S210 and S220).

Next, with reference to Figure 8 will be described the effect of the abnormal VoIP traffic detection system according to an embodiment of the present invention.

8 is a view for explaining the effect of the abnormal VoIP traffic detection system according to an embodiment of the present invention.

In the case of an abnormal VoIP traffic detection system 100 according to an embodiment of the present invention, abnormal SIP traffic on a network (for example, a VoIP network) may be detected. Referring to FIG. 8, in the case of the conventional abnormal traffic detection system, since abnormal traffic is detected only by 5-tuple information, one destination (one source) at one source (IP) at the IP level as shown in FIG. In the case of traffic flowing to a destination, even though a different URI (multiple different From) is used to attack one target (one To) at the application level, it is not detected as a DDoS attack.

However, since the abnormal VoIP traffic detection system 100 according to an embodiment of the present invention detects the DDoS attack traffic based on various information as described above at the application level, the SIP DDoS attack traffic as shown in FIG. Detection is possible.

In addition, the abnormal VoIP traffic detection system 100 according to an embodiment of the present invention detects potential SIP DDoS attack traffic by performing behavior-based analysis and heuristic SIP pattern variation analysis in stages as described above, and this potential SIP DDoS. By analyzing the request method and response method for attack traffic and detecting potential SIP DDoS attack traffic as SIP DDoS attack traffic, it is possible to detect abnormal SIP traffic on VoIP network according to systematic steps.

Although the embodiments of the present invention have been described above with reference to the accompanying drawings, the present invention is not limited to the above embodiments but may be manufactured in various forms, and having ordinary skill in the art to which the present invention pertains. It will be understood by those skilled in the art that the present invention may be embodied in other specific forms without changing the technical spirit or essential features of the present invention. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive.

10: receiving module 40: detection module
50: SIP DDoS attack detection module 60: SIP SCAN attack detection module
70: RTP DDoS attack detection module 80: collection DB
85: statistics DB 90: logs DB

Claims (13)

A receiving module for receiving traffic information on the network;
A detection module receiving the traffic information from the receiving module and analyzing the traffic to detect whether there is a SIP DDoS attack, a SIP SCAN attack or an RTP DDoS attack in the network; And
A statistics DB providing the plurality of reference values needed for the detection module to analyze the traffic,
Detecting the SIP DDoS attack traffic includes detecting behavioral SIP DDoS attack traffic by performing behavior-based analysis and heuristic SIP pattern variation analysis on the traffic on the network, and requesting method and response to the potential SIP DDoS attack traffic. Analyzing a method to detect the potential SIP DDoS attack traffic as the SIP DDoS attack traffic,
The heuristic SIP pattern variation analysis includes analyzing a recent variation of an item determined as abnormal as a result of the behavior-based analysis. The method of claim 1,
The network comprises a VoIP network,
The traffic information abnormal VoIP traffic detection system including netflow (Netflow) based SIP traffic information. The method of claim 1,
The behavior-based analysis includes abnormal VoIP traffic detection system including user distribution pattern analysis, call behavior pattern analysis, and network state analysis. The method of claim 3, wherein
The user distribution pattern analysis includes SIP address distribution analysis and SIP address-IP address association analysis,
The call behavior pattern analysis includes request message transmission number and rate analysis and call transaction rate analysis.
The network state analysis includes an SIP application traffic volume analysis and media traffic quality analysis. delete The method of claim 1,
The detection of the SIP DDoS attack includes calculating a detection score based on the behavior-based analysis result and the heuristic SIP pattern variation analysis result, and detecting the traffic as the SIP DDoS attack traffic when the score is above a predetermined threshold. VoIP traffic detection system. The method of claim 1,
The detection module is an abnormal VoIP traffic detection system including a SIP DDoS attack detection module, SIP SCAN attack detection module and RTP DDoS attack detection module. 8. The method of claim 7,
The SIP DDoS attack detection module detects a corresponding score if any one of the From-To rate, the SIP bps, the SIP bytes rate, the number and rate of SIP request message transmissions, and the call transaction rate is greater than each reference value. Calculate the
If the item larger than the reference value is larger than the T value calculated by the following equation, the detection score is multiplied by 2,
An abnormal VoIP traffic detection system for detecting the traffic as the potential SIP DDoS attack traffic if the sum of the detection scores for all the items is equal to or greater than a predetermined threshold.

T = S + E, where S is the mean of 30 second increments over the last N minutes, and E is the standard deviation of the variance over 30 seconds increments over the last N minutes * 2 The method of claim 8,
The SIP DDoS attack detection module determines that the potential SIP DDoS attacks have potential SIP DDoS attack traffic when the number of request methods is greater than zero but the ACK method is zero, or when the ratio of the number of response methods to the number of request methods exceeds five. An abnormal VoIP traffic detection system for detecting attack traffic as the SIP DDoS attack traffic. 8. The method of claim 7,
The SIP SCAN attack detection module calculates a detection score corresponding to any one item of the SIP bps, the SIP bytes rate, the number and rate of SIP request message transmissions, and the call transaction rate of the traffic that is greater than each reference value.
And detecting the traffic as the SIP SCAN attack traffic when the sum of the detection scores for all the items is equal to or greater than a predetermined threshold. 8. The method of claim 7,
The RTP DDoS attack detection module calculates a corresponding score when any one item of the RTP bps, RTP bytes rate, and MoS value of the traffic is larger or smaller than each reference value.
An abnormal VoIP traffic detection system for detecting the traffic as the potential RTP DDoS attack traffic if the sum of the detection scores for all the items is equal to or greater than a predetermined threshold. 12. The method of claim 11,
The RTP DDoS attack detection module is an RTP flow without a matching SIP session to which the potential RTP DDoS attack traffic is matched, or if the value of (InBytes / OutBytes * 100) of the potential RTP DDoS attack traffic is greater than a specific value, the potential RTP DDoS attack traffic module. An abnormal VoIP traffic detection system for detecting attack traffic as the RTP DDoS attack traffic. The method of claim 1,
The reference value is abnormal VoIP traffic detection system is updated in real time according to the traffic analysis result of the detection module.

Images