KR101231035B1 - A system of invite flooding attack detection and defense using sip in voip service and the mehtod thereof - Google Patents

Abstract

PURPOSE: An invite flooding attack detection and protection system and a method thereof in a VoIP(Voice over Internet Protocol) service using an SIP(Session Initiation Protocol) are provided to distribute messages from an SIP proxy server to the other SIP proxy server in case of invite flooding attack, one of the DoS/DDoS(Denial of Server/Distributed DoS) of VoIP. CONSTITUTION: The other proxy server except for a proxy server inspects traffic due to increase of messages within a server. The other proxy server confirms IP and Terminal information of a corresponding message. The other proxy server distinguishes a normal message from Invite Message Attack. The other proxy server informs the distinguished result to the proxy server first sent the normal message and attack message information. The proxy server collecting the information operates a DDoS defense system against to the attack message. The proxy server collecting the information normally processes the normal message.

Description

A system of Invite Flooding Attack Detection and Defense Using SIP in VoIP Service and the mehtod

The present invention relates to a system for detecting and defending an Invite Flooding attack in a VoIP service using SIP, and more particularly, to a method for distributing a message in a SIP proxy server during an Invite Flooding attack, one of DoS / DDoS of VoIP, and a MAC. It detects attack by checking fixed user information other than IP such as address and user number, and sends phone infected by attack agent to attack blocking service to reduce resource exhaustion and defend through Invite attack message search technique. An Invite Flooding attack detection and defense system in VoIP service using SIP and a method thereof.

As a prior art, Korean Patent No. 1037575 relates to a DDoS attack detection and detection efficiency measuring method using a SIP call control protocol method in a VoIP environment, and particularly, (a) obtaining a plurality of SIP message information; (b) processing any one or more of Invite, Register, and Ack from the obtained SIP message information to process one or more of call connection connection setting values and Cancel, Bye, and OK to process connection end setting variable values; ; (c) Calculate the probability that the connection will succeed without a DDoS attack, the probability that the connection will be successful after receiving a DDoS attack, the probability that the connection will terminate normally without receiving a DDoS attack, and the probability that the connection is terminated normally after receiving a DDoS attack. Making; (d) Calculate a connection establishment probability function that is set as a probability that the connection is successful without the DDoS attack and the probability that the DDoS attack is received but the connection is successful, and a probability that the connection is normally terminated without the DDoS attack. Calculating a preset connection termination probability function with a probability that the DDoS attack is received but the connection is normally terminated; And (e) when the connection establishment probability function exceeds a threshold of a preset connection establishment probability function, or when the connection termination setup probability function exceeds a threshold of a preset connection termination setup function, a DDoS attack. Decision attack detection method comprising a; step of determining.

In addition, Korean Patent Application Publication No. 2011-0055768 relates to a method for determining an upper limit value of an occurrence message and a SIP INVITE flooding attack detection method using the same. The present invention calculates the number of possible messages per unit time in real time based on a network situation. After determining the upper limit of the occurrence message, it is used to acquire the information on the traffic pattern, and to determine and update the detection threshold value of the normal / warning / attack state based on the traffic pattern thus obtained. Even if you exclude the SIP traffic profiling analysis process, you can detect SIP INVITE flooding attacks more accurately and continuously by reflecting the network situation in real time, and use them for attack detection by shortening unnecessary detection preparation period according to SIP traffic profiling analysis. Time and money It is a reduction.

In general, VoIP (Voice over Internet Protocol) service is a voice communication technology that has advantages such as low cost of communication using IP protocol, unlike existing public switched telephone network (PSTN). It is a replacement service, and is used by many users as a new Internet convergence service. However, VoIP services have various security problems such as IP Spoofing, DoS (Denial of Server) / DDoS (Distributed Denial of Service), and so on. In VoIP service, DDoS attack sends a large amount of attack messages to proxy server, which exhausts server resources and prevents normal service.

Also, Invite Flooding attack among DoS and DDoS attacks sends thousands of Invite messages per minute, which depletes the resources of the line. Especially in case of attack by forging IP / Port, attack packet cannot be blocked because it is difficult to detect.

Specifically, since the launch of the iPhone in Korea through KT in 2009, the domestic smartphone market has been growing. Today's smartphones, unlike traditional mobile phones, have the advantage of being able to add features tailored to users with a variety of applications. In other words, while existing phones only use features that have been provided by closed systems and vendors, smartphones can add a variety of features through the iPhone's App Store and Android's Market, but the risks of smartphones are common PCs. Increasing to the same level. In particular, Android is an open source OS, which is widely used worldwide, but the risk is high.

Recently, VoIP services have been available using smartphone applications, such as Skype. Domestic VoIP technology has been provided with commercial Internet telephony service since July 2005, and the number of users has increased rapidly due to the low cost of call and the availability of various additional services than existing PSTN network phones.

As shown in FIGS. 1 and 2, representative techniques used in call setup among VoIP services include Session Initiation Protocol (SIP) and H.323. In particular, SIP provides the convenience of implementation by using text messages, but it is easy to operate and is vulnerable to attacks such as DoS and DDoS. Invite flooding attack among DoS and DDoS attacks paralyzes the circuit by sending thousands of Invite messages per minute. It has a problem that blocking packets cannot be detected because the attack packets are difficult to detect by forging IP and port.

Therefore, during Invite Flooding attack, one of DoS / DDoS of VoIP, SIP proxy server distributes messages, checks fixed user information other than IP such as MAC address and user number, detects attack, and attacks infected phone There is a need for new systems and methods to send to interception services for recovery.

In order to solve the above problems, the present invention provides a method for distributing messages from a SIP proxy server to another SIP proxy server and a fixed user information other than IP such as MAC address and user number during an Invite Flooding attack, one of DoS / DDoS of VoIP. Its purpose is to provide an Invite Flooding attack detection and defense system in VoIP service using SIP that detects and detects an attack and sends a phone infected with an attack agent to an attack blocking service for recovery.

According to the present invention, when the traffic of a proxy server increases due to an Invite Message Attack, distributing the message of the proxy server to the connected proxy servers in the vicinity, and the other proxy server examines the traffic caused by the increase of messages in the server. , Distinguishing the normal message from the Invite Message Attack by checking the IP and terminal information of the corresponding message, informing the proxy server that originally sent the normal message and the attack message information, and the proxy server that collected the information to the attack message. The DDoS defense system is activated and normal messages are processed normally.

The present invention connects proximate proxy servers to one network and sends status information including CPU information to connected proxy servers in order to reduce the burden of delivering a large number of messages to the proxy server attacked by a sudden DDoS attack. Forwarding, distributing the message to other proxy servers in the vicinity when the Invite message attacks the one proxy server.

The amount of traffic distributed in the step of distributing the requested message of the proxy server to the connected proxy server around is expressed by Equation 1 below.

[Equation 1]

: 각 프록시 서버의 CPU 점유율의 합, AT : INVITE Flooding Attack를 감지한 프록시 서버에서 현재 수신된 전체 메시지의 양 = 증가한 트래픽의 메시지 양, TA[m] : 프록시 서버 m에 전송되는 메시지의 양)(Where m: object number of proxy server, PSC [m]: CPU usage of proxy server m, PSC _RE [m]: derivation formula for (100-PSC [m]) calculation, PSC _RE [k]: CPU usage of each proxy server,

: Sum of CPU shares of each proxy server, AT: Total amount of messages currently received from the proxy server that detected the INVITE Flooding Attack = Message amount of increased traffic, TA [m]: Amount of messages sent to proxy server m)

Invite flooding attack detection and defense system in the VoIP service using SIP is detected as an attack if an attack is detected by performing duplicate message checks with outgoing IP address information when an attack with increasing traffic is detected in a packet. In the case of traffic inspection, it checks the traffic increase caused by abnormal traffic and considers it as not an attack if there is no abnormality, and performs the traffic inspection again and collects the IP and the carrier's authentication information and MAC address of the message. When multiple Invite messages are sent from within, it is recognized as an attack, and the attack defense system is executed. If there is no abnormality, it is regarded as not an attack, and when the attack is found, it blocks the messages sent by the malicious bots. This step is to activate an attack defense system that induces treatment. Lure.

The present invention comprises a location server that has registered a location of a user and proxy servers that deliver the requested message to a place where the actual message should be delivered. When the traffic of the proxy server increases due to an Invite Message Attack, the proxy Distributes the requested message from the server to the connected proxy server, and other proxy servers except the proxy server inspect the traffic caused by the increase of the message in the server, check the IP and the terminal information of the corresponding message, Distinguish the Invite Message Attack, inform the proxy server that originally sent the normal message and the information of the attack message, and the proxy server that collected the information operates the DDoS defense system for the attack message, and normal message is processed normally.

The present invention connects proximate proxy servers to one network and sends status information including CPU information to connected proxy servers in order to reduce the burden of delivering a large number of messages to the proxy server attacked by a sudden DDoS attack. In other words, when an Invite message attacks a proxy server, the message is distributed to other proxy servers in the vicinity.

In the case of distributing the requested message of the proxy server to the adjacent connected proxy server, the amount of traffic to be distributed is shown in Equation (1).

Invite flooding attack detection and defense system in VoIP service using SIP is regarded as an attack when an attack is detected by detecting duplicate message with outgoing IP address information when attacking with increasing traffic in a packet is found, and there is no attack In this case, the traffic is examined to check the traffic increase caused by abnormal traffic. If there is no error, it is regarded as not an attack, and the traffic is checked again, the IP of the message and the authentication information of the carrier and the MAC address are collected. When a message is sent, it is recognized as an attack and an attack defense system is executed. If there is no abnormality, it is regarded as an attack if there is no abnormality. Activate the system.

According to the present invention, during an Invite attack, one of DoS and DDoS attacks during a VoIP attack using SIP, it reduces resource depletion due to an attack message to one proxy server through traffic distribution of a proxy server, and defends through an Invite attack message search technique. can do.

1 is a diagram illustrating a communication flow using SIP according to the related art.
2 is a view showing an Invite Flooding massage Flow according to the related art.
Figure 3 shows the overall configuration according to the invention and the operation sequence accordingly.
4 is a diagram illustrating a procedure of an Invite Flooding attack detection and defense method in a VoIP service using SIP according to the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

Invite flooding attack detection and defense system in the VoIP service using the SIP according to the present invention and the location server (Location server; 10) registered the location of the user, and delivers the requested message to the place where the actual message should be delivered It consists largely of Proxy Servers 20, 21, 22, and 23.

As shown in FIG. 3, when the traffic of the proxy server 20 increases due to an Invite Message Attack, the requested message of the proxy server 20 is transmitted to the adjacent connected proxy servers 21, 22, and 23. In addition to the proxy server 20, other proxy servers 21, 22, and 23 inspect the traffic caused by the increase of messages in the server, and check the normal message and the Invite Message Attack by checking the IP and the terminal information of the corresponding message. It is desirable to distinguish between the normal message and the attack message to the proxy server that originally sent the information, and to collect the information, the proxy server operates the DDoS defense system for the attack message, and normal message is normally processed.

On the other hand, in order to reduce the burden of delivering a large number of messages to the proxy server 20 that is attacked by the sudden DDoS attack, the adjacent proxy server (21, 22, 23) is connected to one network and includes each CPU information It is preferable to transmit the status information to the connected proxy servers so that when the Invite message attacks on one proxy server, the message is distributed to other proxy servers in the vicinity.

In this case, when the message requested by the proxy server is distributed to the connected proxy server, the amount of traffic to be distributed is expressed by Equation 1 below.

은 각 프록시 서버의 CPU 점유율의 합이고, AT 는 INVITE Flooding Attack를 감지한 프록시 서버에서 현재 수신된 전체 메시지의 양, 즉 증가한 트래픽의 메시지 양이며, TA[m] 은 프록시 서버 m에 전송되는 메시지의 양이다. 단 TA[0]는 발신하는 프록시 서버의 메시지 양을 나타낸다.Where m is the object number of the proxy server, PSC [m] is the CPU usage of proxy server m, PSC _RE [m] is a derivation for (100-PSC [m]) calculation, and PSC _RE [k ] Is the CPU usage of each proxy server,

Is the sum of the CPU shares of each proxy server, AT is the total amount of messages currently received from the proxy server that detected the INVITE flooding attack, that is, the amount of increased traffic, and TA [m] is the message sent to proxy server m. Is the amount. TA [0], however, indicates the message amount of the originating proxy server.

In addition, the Invite Flooding attack detection and defense system in the VoIP service using SIP is regarded as an attack when an attack is detected by performing a duplicate message check with the originating IP address information when an attack increasing in traffic is detected. If there is no traffic, it checks the traffic increase caused by abnormal traffic. If there is no error, it considers it as not an attack. It checks traffic again, collects the IP address of the message and the authentication information and MAC address of the mobile operator. When an Invite message is sent, it is recognized as an attack and the attack defense system is executed. If there is no error, it is considered as not an attack, and when an attack is found, it blocks the message sent by malicious bots and induces treatment according to the type of device. Activate the defense system.

Therefore, during Invite attack, which is one of DoS and DDoS attacks during VoIP using SIP, it can reduce resource exhaustion caused by attack message to one proxy server through traffic distribution of proxy server, and defend through Invite attack message search technique. .

Hereinafter, an Invite Flooding attack detection and defense method in a VoIP service using SIP will be described in detail.

The present invention is to detect the attack by checking message distribution method in SIP proxy server and fixed user information other than IP such as MAC address and user number during Invite Flooding attack which is one of DoS / DDoS of VoIP. Send a message to the attack blocking service to recover.

As shown in Fig. 3, when the traffic of the proxy server increases due to the Invite Message Attack (step 1), the message is distributed to the connected proxy servers around the server (step 2).

The other proxy server checks the traffic caused by the increase of the message in the server, checks the IP and the terminal information of the corresponding message, distinguishes the normal message from the Invite Attack message, and sends the information of the normal message and the attack message to the proxy server that originally sent the message. Notify (steps 3 and 4).

Subsequently, the proxy server which collects the information activates the DDoS defense system for the attack message, and normal message is processed normally (step 5).

In other words, in order to reduce the burden of delivering a large number of messages to a proxy server attacked by a sudden DDoS attack, the adjacent proxy servers are connected to one network, and status information including CPU information is transmitted to the connected proxy servers. When an Invite message attacks a proxy server, it distributes the message to other proxy servers around it.

Herein, the amount of traffic distributed in the step of distributing the requested message of the proxy server to the adjacent connected proxy servers is expressed by Equation 1 above.

On the other hand, as shown in Figure 4, if the attack of the Invite Flooding attack detection and defense system in the VoIP service using the SIP first to increase the traffic in the packet is detected by the duplicate message check with the originating IP address information Consider it an attack (Phase 1).

If there is no aggression, the traffic is examined to check the increase in traffic caused by abnormal traffic.

If the aggression is not detected in the first step, traffic inspection is performed again, and the IP of the message, the authentication information of the carrier and the MAC address are collected (steps 3 and 4).

When multiple Invite messages are sent within the same information, it is recognized as an attack and the attack defense system is executed. If there is no abnormality, it is regarded as not an attack, and when an attack is found, it blocks a message from a malicious bot and activates an attack defense system that induces treatment according to the terminal type (step 5).

The present invention described above is capable of various substitutions, modifications, and changes without departing from the technical spirit of the present invention for those skilled in the art to which the present invention pertains. It is not limited by.

10: location server
20, 21, 22, 23: proxy server

Claims (8)

If the traffic of the proxy server increases due to an Invite Message Attack, distributing the message of the proxy server to the adjacent connected proxy servers;
The other proxy server checks the traffic caused by the increase of the message in the server, checks the IP and the terminal information of the corresponding message, distinguishes the normal message from the Invite Message Attack, and sends the information of the normal message and the attack message to the proxy server that originally sent the message. Informing;
The proxy server collects the information to operate the DDoS defense system for the attack message, and normal message processing;
The amount of traffic distributed in the step of distributing the requested message of the proxy server to the connected proxy server around the detection of the in-byte flooding attack in the V IP service using the following Equation 1 and Defense method.
[Equation 1]

(Where m: object number of proxy server, PSC [m]: CPU usage of proxy server m, PSC _RE [m]: derivation formula for (100-PSC [m]) calculation, PSC _RE [k]: CPU usage of each proxy server,

: Sum of CPU shares of each proxy server, AT: Total amount of messages currently received from the proxy server that detected the INVITE Flooding Attack = Message amount of increased traffic, TA [m]: Amount of messages sent to proxy server m)
delete delete The method of claim 1,
When the attack service and detection system of the IP flood service using the SIP detects an aggressive attack that increases traffic in the packet, it is considered an attack if the attack is detected by performing a duplicate message check with the source IP address information. ,
Inspecting traffic when there is no aggression, examining traffic increase caused by abnormal traffic, and deciding that it is not an attack when there is no abnormality;
Inspecting traffic again and collecting the IP of the message, authentication information of the carrier and the MAC address;
Recognizing this as an attack when several Invite messages are sent within the same information and executing an attack defense system, deeming it as not an attack if there is no abnormality;
Activating an attack defense system that blocks a message from a malicious Bot when an attack is found and induces treatment according to the terminal type;
In-byte flooding attack detection and defense method in the V IP service using SIP. A location server that has registered the location of the user;
Proxy servers that deliver the requested message to where the actual message should be delivered;
When the traffic of the proxy server increases due to an Invite Message Attack, the message distributed by the proxy server is distributed among the connected proxy servers, and other proxy servers except for the proxy server cause the traffic to increase in the server. Checks the IP and the terminal information of the corresponding message, distinguishes between normal message and Invite Message Attack, informs the proxy server that originally sent the normal message and the attack message information, and collects the information from the proxy server. Activate the DDoS defense against
In the case of distributing the requested message of the proxy server to the adjacent connected proxy server, the amount of traffic to be distributed is detected as an in-byte flooding attack in the VIP service using Equation 1 below. Defense system.
[Equation 1]

(Where m: object number of proxy server, PSC [m]: CPU usage of proxy server m, PSC _RE [m]: derivation formula for (100-PSC [m]) calculation, PSC _RE [k]: CPU usage of each proxy server,

: Sum of CPU shares of each proxy server, AT: Total amount of messages currently received from the proxy server that detected the INVITE Flooding Attack = Message amount of increased traffic, TA [m]: Amount of messages sent to proxy server m) delete delete The method of claim 5,
In-byte flooding attack detection and defense system in the V IP service using the SIP,
If aggression with increasing traffic is found in the packet, duplicate message inspection with outgoing IP address information is considered. If an aggression is detected, it is considered an attack. If there is no aggression, the traffic is inspected by checking the traffic increase caused by abnormal traffic. Is not considered an attack,
It checks traffic again and collects message IP and carrier's authentication information and MAC address. When multiple Invite messages are sent within the same information, it is recognized as an attack and the attack defense system is executed. Is considered,
Intrusion flooding detection and defense system in the BIP service using SIP, which blocks the message sent from the malicious Bot and detects the attack, and activates an attack defense system that induces treatment according to the terminal type.

Images