KR101586626B1 - SIP Detection System and SIP Attack and Abnormal Detection Method Thereby In 4G Mobile Communication Network - Google Patents

Abstract

Disclosed are a system for detecting a session initiation protocol (SIP) attack and an abnormal activity, which can reduce overload and a fault occurring in network equipment, and a method for detecting an SIP attack and an abnormality by the same. According to the present invention, the SIP detection system in a 4G mobile communication network comprises: a subscriber terminal to be connected to an IP multimedia subsystem (IMS) network which provides a VoLTE service to transmit an SIP request message; an IMS to transmit an SIP response message to the subscriber terminal via the IMS network in response to the SIP request message; and an SIP detection device to receive the SIP response message from each subscriber terminal, and calculate an accumulation value accumulated for a period of time predetermined for each subscriber terminal from a response code of an SIP header contained in the received SIP response message to treat as an SIP attack and an abnormal activity if the accumulation value exceeds a threshold. Accordingly, the present invention detects an SIP attack and an abnormal activity in advance based on response SIP traffic to reduce overload and a fault occurring in IMS network equipment and DoS.

Description

Technical Field [0001] The present invention relates to a SIP detection system in a 4G mobile communication network, and a SIP attack and an abnormal detection method using the SIP detection system and a SIP attack and an abnormal detection method in a 4G mobile communication network.

The present invention relates to a system for detecting a SIP attack and an abnormal behavior in a 4G mobile communication network, and a SIP attack and an abnormal detection method by the system, and more particularly, to a SIP attack and an abnormal A system in a 4G mobile communication network for detecting an action, and a SIP attack and an abnormal detection method by the system.

Generally, LTE technology has been standardized by 3GPP, an international standardization organization for mobile communications, in consideration of the surge of data traffic and the convergence of existing mobile communication networks with wired / wireless networks as smartphones become more popular.

In 3GPP, since LTE technology is designed in a way that is optimized for packet switching (PS), VoIP (Voice over IP) is introduced to provide voice service to mobile communication network. To this end, GSMA defined Voice over LTE (VoLTE) to provide high-quality voice services over the LTE network, an all-IP network.

VoLTE means to provide all-IP-based seamless service through IMS (IP Multimedia subsystem) network by using SIP (Session Initiation Protocol) method for voice, text, video call and multimedia contents in mobile communication network.

In this case, the IMS has a CSCF (Call Session Control Function) and an AS (Application Server) in order to provide IP-based voice and various multimedia services in various wired / wireless networks and mobile terminals. We used SIP, a text-based signaling protocol.

Since SIP used in VoLTE is text-based, there exist SIP Malformed attack and SIP SQL Injection attack that attack SIP server by manipulating SIP request (Request) message. These attacks are problems of SIP server, CSCF malfunction and DoS .

Conventionally, there is a method of analyzing SIP request message based on regular expression. However, in VoLTE, there is a difficulty in analyzing all SIP request messages due to an increase in VoLTE traffic due to an increase in VoLTE subscribers.

For example, a text-based SIP request message transmitted by a subscriber terminal for a VoLTE service is delivered to the IMS through an EPC (Evolved Packet Core), which is a core of LTE, without filtering. The CSCF of the IMS processes the SIP request message and transmits a SIP response message to the subscriber terminal to provide a VoLTE service to the subscriber terminal.

At this time, the SIP response message is divided into a response code (Status-code) of 1xx-6xx. Among them, 4xx-6xx contains data that the SIP request message is erroneous or can not be performed by the CSCF.

In this case, according to the SIP characteristic of the response according to the request as described above, the attacker could collect information about VoLTE service or IMS network by transmitting a manipulated SIP message for VoLTE service attack or abuse to IMS. Also, Malicious and frequent attack / abnormal SIP message transmission by a terminal or a hacker has caused problems such as DoS caused by overloading of IMS network equipment and further damage of VoLTE service due to IMS failure.

Title: Detection and monitoring system of abnormal S-IP traffic congestion attack using net flow statistic information and method therefor.

SUMMARY OF THE INVENTION The present invention has been conceived to solve the above-mentioned problems, and it is an object of the present invention to provide a system for detecting SIP attacks and abnormalities in a 4G mobile communication network based on a SIP response message in response to an attack / And a method thereof.

The features of the present invention for achieving the objects of the present invention as described above and performing the characteristic functions of the present invention described below are as follows.

According to an aspect of the present invention, there is provided a subscriber terminal connected to an IMS network providing a VoLTE service and transmitting a Session Initiation Protocol (SIP) request message; An IMS (IP Multimedia Subsystem) for transmitting a SIP response message to the subscriber station through the IMS network in response to the SIP request message; And an accumulation value accumulated for a predetermined time period by the subscriber terminal from a response code of a SIP header included in the received SIP response message, when the SIP response message is received for each subscriber terminal, A SIP detection system in a 4G mobile communication network including a SIP detection apparatus regarded as an operation is provided.

Here, the SIP detection apparatus according to an aspect of the present invention may include an IP extraction unit for extracting a corresponding subscriber terminal IP when the response code (StatusCode) exists in the managed response code list.

In addition, the SIP detection apparatus according to an aspect of the present invention may further include a class determination unit for determining whether the extracted subscriber station IP exists in a DetectSession list and a status list object, respectively.

In addition, the class determination unit according to an aspect of the present invention may include a first class determination unit for determining whether the subscriber station IP exists in the DetectSession list, and generating a DetectSession object of the subscriber station IP when the determination is unsuccessful; And a second class determiner for determining whether the subscriber station IP corresponding to the state list object exists if it is determined that the subscriber station IP exists in the DetectSession list.

In addition, the first class determiner according to an aspect of the present invention includes a Call-ID list object for specifying Call-ID, CSCF IP, Method Type, count, and start / It is possible to create the DetectSession object in which a SIP Method object is specified as an attribute value.

In addition, the second class determination unit according to an aspect of the present invention can generate a state object when the subscriber station IP exists in the DetectSession list and the response code matching the state list object does not exist.

In addition, the second class determination unit according to an aspect of the present invention may add an attribute value according to a new response code to the response code object.

If the subscriber station IP exists in the DetectSession list and there is a response code corresponding to the state list object, the first class determining unit according to an aspect of the present invention determines the S_count and the SIP Method type of the DetectSession object by 1 .

In addition, the SIP detecting device according to an aspect of the present invention increases the S_count and SIP Method types by 1, and if there is no matching Call-ID in the DetectSession object, the SIP detecting device increments the CSCF IP A Method class, a Method type, a C_count, and a Start / Detect_time, and if there is a CSCF IP, a Method type, and a Detect_time according to the Call-ID, .

In addition, the SIP detection apparatus according to an aspect of the present invention generates a detection message when S_count summation of the state list object for each IP address of the subscriber terminal exceeds a threshold value (h), and if not, And a threshold value determiner for performing the calculation.

In addition, the threshold determining unit according to an aspect of the present invention can delete the corresponding Call-ID if the Start_time of the Call-ID is greater than the set value (S_time) with respect to the current time.

According to another aspect of the present invention, there is provided a method for providing a VoLTE service, the method comprising: (a) transmitting a Session Initiation Protocol (SIP) request message to an IMS network providing a VoLTE service; (b) transmitting a SIP response message in response to the SIP request message from the IMS (IP Multimedia subsystem) to the subscriber station through the IMS network; And (c) receiving, at the SIP detecting device, the SIP response message for each subscriber terminal, and accumulating an accumulated value accumulated for a predetermined time period for each subscriber terminal from a response code of a SIP header included in the received SIP response message, A SIP attack and an abnormal detection method of a SIP detection system including a step of counting a SIP attack and abnormality when calculating and exceeding a threshold value are provided.

As described above, according to the present invention, it is possible to reduce the overload and the trouble generated in the IMS network equipment by detecting the SIP attack and the abnormality in advance based on the response SIP traffic.

In addition, the present invention has an effect of preventing a call session control function (CSCF) from malfunctioning by detecting SIP attacks and abnormalities in advance based on the response SIP traffic.

FIG. 1 is an exemplary diagram illustrating a SIP detection system 100 according to a first embodiment of the present invention.
Figure 2 is a more detailed view of SIP detection device 130 of SIP detection system 100 according to the first embodiment of the present invention.
FIG. 3 is a flowchart exemplarily showing a SIP attack and an abnormal detection method (S100) of the SIP detection system 100 according to the second embodiment of the present invention.
FIGS. 4 to 6 are flowcharts illustrating a flow of a SIP attack and an abnormal detection method (S100) performed in the SIP detection apparatus 130 according to the second embodiment of the present invention in more detail.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings, so that those skilled in the art can easily carry out the present invention. In the drawings, like reference numerals refer to the same or similar functions throughout the several views.

FIG. 1 is an exemplary illustration of a SIP detection system 100 according to a first embodiment of the present invention, and FIG. 2 is a block diagram of a SIP detection device 130 of a SIP detection system 100 according to a first embodiment of the present invention ) In more detail.

As shown, the SIP detection system 100 according to the first embodiment of the present invention includes a subscriber station 110, an IP Multimedia subsystem (IMS) 120, and a SIP detector 130 ).

First, the subscriber station 110 according to the present invention accesses an IMS network providing a VoLTE service, and transmits a Session Initiation Protocol (SIP) request message to the IMS 120 to be described later.

At this time, VoLTE service means to provide continuous service based on All IP through IMS (IP Multimedia subsystem) architecture by using SIP (Session Initiation Protocol) in voice, text, video call and multimedia contents in mobile communication network do.

The subscriber terminal 110 may be composed of at least one terminal, and at least one terminal generates a malicious SIP malformed attack and a SIP SQL injection attack that attack the SIP server by manipulating a SIP request message Provide the cause.

 Next, the IP Multimedia Subsystem (IMS) 120 according to the present invention transmits a SIP response message to the subscriber station through the IMS network in response to the malicious SIP request message generated in the at least one subscriber station 110 . In this case, when the text-based SIP request message is delivered to the IMS through EPC (Evolved Packet Core), which is the core network of LTE, without filtering, the CSCF of the IMS 120 processes the SIP request message, And transmits the VoLTE service to the subscriber terminal through the network.

At this time, the SIP response message is divided into a response code (Status-code) of 1xx-6xx, of which 4xx-6xx may contain contents that the SIP request message is erroneous or can not be performed by the CSCF. The IMS 120 communicates with at least one subscriber terminal 110 via a wired or wireless network, such as an IMS network.

Lastly, the SIP detection apparatus 130 according to the present invention receives a SIP response message together with the SIP request message for each subscriber station 110, and analyzes a SIP attack and an abnormal state of the SIP traffic. For example, as described above, SIP attack and abnormal state of a SIP request message including 4xx-6xx are analyzed.

At this time, the SIP detection device 130 according to the present invention performs a detailed analysis of the received SIP response message. For example, from the response code of the SIP header included in the SIP response message, If a cumulative value is calculated and exceeded the threshold value, it is regarded as a SIP attack and abnormal activity.

For this, the SIP detection apparatus 130 according to the present invention may include an IP extraction unit 131, a class determination unit 132, and a threshold determination unit 133.

First, the IP extracting unit 131 extracts a SIP response message from the SIP response message in the S1-U period (eNodeB↔S-GW) or the S5 period (S-GW↔P-GW) (GTP-C / U) traffic. For example, when the response code (StatusCode) of the SIP response message exists in the response code list being managed, it is regarded that the SIP attack and the abnormal behavior are expected, .

At this time, if the response code in the managed response code list starts with '401', the subscriber terminal IP can be extracted by checking whether Is Inbound (GTP packet direction) is '1'. In the response code list, IP, src / desc, Call-ID, Cseg, and timestamp exist in addition to the response code.

On the other hand, in the case of Is Inbound (GTP packet direction) having '1', the class determination unit 132 according to the present invention determines whether the subscriber terminal IP extracted by the IP extraction unit 131 described above is included in the DetectSession list and the state list object Respectively. At this time, the DetectSession list includes a subscriber terminal IP and a status object.

For this determination, the class determination unit 132 according to the present invention includes a first class determination unit 132-1, a second class determination unit 132-2, and a third class determination unit 132-3 do. First, the first class determiner 132-1 according to the present invention determines whether the subscriber station IP extracted from the IP extractor 131 exists in the DetectSession list, and generates a DetectSession object of the subscriber station IP.

At this time, the generated DetectSession object has the Status-code, S_count, and SIP Method object as the attribute value as well as the Call-ID List object having the Call-ID, CSCF IP, Method Type, count, and start / . For example, you can create a DetectSession object with a Status object of count = 1, a Call-ID object of count = 1, and start / detect time = timestamp. In this case, the method type is increased by the matching variable 1 through Cseq. After this processing, the IP extraction unit 131 described above is performed.

On the other hand, the second class determiner 132-2 according to the present invention determines whether the subscriber station IP exists in the DetectSession list by the first class determiner 132-1, It is determined whether there is a subscriber terminal IP matching the list object.

For example, the second class determination unit 132-2 according to the present invention generates a state object when the subscriber terminal IP exists in the DetectSession list and the response code matching the state list object does not exist. At this time, the state object means information added with an attribute value according to a new response code. After this processing, the threshold value determination unit 133 to be described later is performed.

However, when the subscriber terminal IP exists in the DetectSession list and the response code matching the state list object exists, the second class determiner 132-2 according to the present invention increments the S_count and SIP Method type of the DetectSession object by 1 .

Then, the third class determiner 132-3 according to the present invention increments the S_count and SIP Method types by 1 as described above, and then determines that there is no matching Call-ID in the DetectSession object , It is possible to generate a Call-Id object to which a CSCF IP according to the Call-ID, a Method type, a C_count, and a Start / Detect_time are added. After this processing, the threshold value determination unit 133 to be described later is performed.

However, when it is determined that a matching Call-ID exists in the DetectSession object, the CSCF IP, Method type, and Detect_time according to the Call-ID can be updated and C_count can be increased by one. After this processing, the threshold value determination unit 133 to be described later is performed.

Finally, the threshold value determiner 133 according to the present invention determines whether or not the CSCF IP, Method type, Detect_time update, and Call-Id object generation of the third class determiner 132-3, 132-2. That is, it is determined whether the S_count summation of the state list object for each subscriber terminal IP exceeds the threshold value h. Except that count is 1.

For example, the threshold determining unit 133 generates a detection message when it determines that the S_count summation of the state list object for each subscriber terminal IP exceeds the threshold value h.

However, when the S_count summation of the state list object for each subscriber terminal IP is determined not to exceed the threshold value h, the threshold determining unit 133 according to the present invention performs time calculation for each Call-ID object. For example, when it is determined that the S_count summation of the state list object of each subscriber terminal IP does not exceed the threshold value h, if the Start_time of the Call-ID is larger than the set value (S_time) after the cycle of each Call-ID object , The corresponding Call-ID is deleted.

If it is determined that the next Call-ID exists, the call-ID object is circulated when the Start_time of the Call-ID is smaller than the set value (S_time) after the circulation of the Call-ID object. However, if there is no next Call-ID, it may be performed by returning to the IP extracting unit 131 described above.

Second Embodiment

FIG. 3 is a flowchart exemplarily showing a SIP attack and an abnormal detection method (S100) of the SIP detection system 100 according to the second embodiment of the present invention, and FIGS. 4 to 6 are flowcharts FIG. 5 is a flowchart illustrating a flow of an SIP attack and an abnormal detection method (S100) performed by the SIP detection device 130 according to an embodiment of the present invention.

As shown in FIG. 3, the SIP attack and abnormal detection method (S100) of the SIP detection system 100 according to the second embodiment of the present invention includes steps S110 to S150 for detecting a SIP attack and an abnormal behavior .

First, in step S110 according to the present invention, a subscriber terminal 110 transmits an SIP (Session Initiation Protocol) request message to an IMS 120 by accessing an IMS network providing a VoLTE service.

At this time, VoLTE service means to provide continuous service based on All IP through IMS (IP Multimedia subsystem) architecture by using SIP (Session Initiation Protocol) in voice, text, video call and multimedia contents in mobile communication network do.

The subscriber terminal 110 may be composed of at least one terminal, and at least one terminal generates a malicious SIP malformed attack and a SIP SQL injection attack that attack the SIP server by manipulating a SIP request message Provide the cause.

Thereafter, in step S120 according to the present invention, a SIP response message is transmitted from the IP multimedia subsystem (IMS) 120 to the subscriber terminal 110 through the IMS network in response to the malicious SIP request message generated in step S110 described above.

In this case, when the text-based SIP request message is delivered to the IMS through EPC (Evolved Packet Core), which is the core network of LTE, without filtering, the CSCF of the IMS 120 processes the SIP request message, And transmits the VoLTE service to the subscriber terminal 110 via the network.

At this time, the SIP response message is divided into a response code (Status-code) of 1xx-6xx, among which 4xx-6xx may contain contents that can not be performed by the CSRF (Call Session Control Function) . The IMS 120 communicates with at least one subscriber terminal 110 via a wired or wireless network, such as an IMS network.

Finally, in step S130 according to the present invention, the SIP detection device 130 receives a SIP response message together with the SIP request message for the subscriber station 110, and analyzes the SIP attack and the abnormal state of the SIP traffic.

For example, as described above, SIP attack and abnormal state of a SIP request message including 4xx-6xx are analyzed. At this time, in step S130 according to the present invention, the received SIP response message is analyzed in detail by the SIP detection device 130. For example, the SIP response message includes a response code of the SIP header included in the SIP response message, Cumulative cumulative value is counted, and if it exceeds the threshold value, it is regarded as SIP attack and abnormal activity.

To this end, step S130 according to the present invention includes steps S131 to S133. In this case, step S131 is shown in FIG. 4, step S132 is shown in FIG. 5, and step S133 is shown in FIG.

In step S131 according to the present invention, the user control / data (GTP) of the SIP response message in the S1-U section (eNodeB↔S-GW) or the S5 section If the response code (StatusCode) of the SIP response message is present in the response code list being managed, the SIP attack and the abnormal operation are regarded as being anticipated, (S131-1).

At this time, if the response code in the managed response code list starts with '401', the subscriber terminal IP can be extracted by checking whether Is Inbound (GTP packet direction) is '1' (S131-2). There are IP, src / desc, Call-ID, Cseg, and timestamp in the response code list as well as the response code.

On the other hand, in step S132 according to the present invention, in the case of Is Inbound (GTP packet direction) having '1', it is determined whether the subscriber terminal IP extracted by the IP extracting unit 131 described above exists in the DetectSession list and the state list object Respectively. At this time, the DetectSession list includes a subscriber terminal IP and a status object.

For this determination, in step S132 according to the present invention, the first class determination unit 132-1 determines whether the subscriber terminal IP extracted by the IP extraction unit 131 exists in the DetectSession list (S132-1) And creates a DetectSession object of the subscriber terminal IP (S132-2).

At this time, the generated DetectSession object has the Status-code, S_count, and SIP Method object as the attribute value as well as the Call-ID List object having the Call-ID, CSCF IP, Method Type, count, and start / .

For example, you can create a DetectSession object with a Status object of count = 1, a Call-ID object of count = 1, and start / detect time = timestamp. In this case, the method type is increased by the matching variable 1 through Cseq. After this processing, step S110 described above is performed.

On the other hand, if it is determined in step S132 that the subscriber terminal IP exists in the DetectSession list (S132-1), the subscriber terminal IP is checked if the subscriber terminal IP exists in the DetectSession list, The determination unit 132-2 determines (S132-3).

For example, if the subscriber terminal IP exists in the DetectSession list and there is no response code matching the state list object in step S132-2, the second class determiner 132-2 (S132-4).

At this time, the state object means information added with an attribute value according to a new response code. After this processing, step S133 to be described later is performed. This will be confirmed later.

However, in step S132-3 according to the present invention, when the subscriber terminal IP exists in the DetectSession list and the second class determiner 132-2 determines that there is a response code matching the state list object, S_count and SIP Method type are incremented by 1 (S132-5).

Thereafter, in step S132 according to the present invention, the S_count and SIP Method types are incremented by 1 in step S132-5, and the third class determination unit 132-3 determines that no matching Call-ID exists in the DetectSession object. (S132-6), the third class determiner 132-3 may generate a Call-Id object to which a CSCF IP, Method type, C_count, and Start / Detect_time according to the Call-ID are added (S132-7). After this processing, step S133 to be described later is performed. This will be confirmed later.

However, when the third class determiner 132-3 determines that there is a matching Call-ID in the DetectSession object, it updates the CSCF IP, Method type, and Detect_time according to the corresponding Call-ID, and increases C_count by 1 (S132-8). After this processing, step S133 to be described later is performed. This will be confirmed later.

Lastly, in step S133 according to the present invention, the CSCF IP, Method type, Detect_time update, and after the Call-Id object generation and state object generation are performed, that is, the S_count summation of the state list object per subscriber terminal IP is equal to or less than the threshold value h) is determined by the threshold value determination unit 133 (S133-1). Except that count is 1.

For example, if it is determined in step S133 that the S_count summation of the state list object for each subscriber terminal IP exceeds the threshold value h, the threshold value determination unit 133 generates a detection message.

However, in step S133 according to the present invention, when the threshold value determination unit 133 determines that the S_count summation of the state list object per subscriber terminal IP does not exceed the threshold value h, the time calculation for each Call-ID object is performed.

For example, when it is determined that the S_count summation of the state list object of each subscriber terminal IP does not exceed the threshold value h, if the Start_time of the Call-ID is larger than the set value (S_time) after the cycle of each Call-ID object (S133-2), and deletes the corresponding Call-ID (S133-3).

If it is determined that the next Call-ID is present (S133-4), or if the Start_time of the Call-ID is smaller than the set value (S_time) after the cycle of each Call-ID object (S133-2) Calls are made for each Call-ID object. However, if it is determined that the next Call-ID exists (S133-4), the process returns to step S110 described above.

As described above, according to the present embodiment, it is possible to prevent an overload and a trouble occurring in the IMS network equipment and to prevent the malfunction of the call session control function (CSCF) by detecting SIP attacks and abnormalities in advance based on the response SIP traffic Gives you an advantage.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the exemplary embodiments or constructions. You can understand that you can do it. The embodiments described above are therefore to be considered in all respects as illustrative and not restrictive.

100: SIP detection system 110: Subscriber terminal
120: IMS 130: SIP detection device
131: IP extracting unit 132:
133: Threshold judging unit 132-1: First class judging unit
132-2: second class judgment unit 132-3: third class judgment unit

Claims (22)

A subscriber terminal connected to an IMS network providing a VoLTE service and transmitting a Session Initiation Protocol (SIP) request message;
An IMS (IP Multimedia Subsystem) for transmitting a SIP response message to the subscriber station through the IMS network in response to the SIP request message; And
Receiving the SIP response message for each subscriber terminal and calculating an accumulation value cumulatively counted for a predetermined time for each subscriber terminal from the response code of the SIP header included in the received SIP response message, SIP detectors considered as SIP attacks and abnormal actions when the value exceeds the threshold value,

The SIP detecting device includes an IP extracting unit for extracting a corresponding subscriber terminal IP when the response code (StatusCode) exists in a response code list being managed,
The SIP detection apparatus further includes a class determination unit for determining whether the extracted subscriber station IP exists in a DetectSession list and a status list object,

The class judging unit judges,
A first class determination unit for determining whether the subscriber station IP exists in the DetectSession list and generating a DetectSession object for the subscriber station IP if the subscriber station IP exists; And
Further comprising a second class determiner for determining whether the subscriber station IP corresponding to the state list object exists if it is determined that the subscriber station IP exists in the DetectSession list,

The first class determiner has a Status-code, an S_count, and a SIP Method object as attribute values as well as a Call-ID List object having Call-ID, CSCF IP, Method Type, count, and start / And the DetectSession object is generated. delete delete delete delete The apparatus of claim 1, wherein the second class determiner comprises:
Wherein the status object is generated when the subscriber station IP exists in the DetectSession list and the response code does not exist in the status list object. The method according to claim 6,
Wherein the second class determination unit determines,
And adds an attribute value according to a new response code to the state object. The apparatus of claim 1, wherein the second class determiner comprises:
Wherein the S_count and SIP Method types of the DetectSession object are incremented by 1 when the subscriber terminal IP exists in the DetectSession list and a response code matching the state list object exists. 9. The method of claim 8,
The class judging unit judges,
If a matching Call-ID does not exist in the DetectSession object after incrementing the S_count and the SIP Method type by 1, a Call-ID including a CSCF IP, a Method type, a C_count, and a Start / Detect_time according to the Call- A third class determination unit for updating the CSCF IP, Method type, and Detect_time according to the corresponding Call-ID, and increasing C_count by 1 if the Id object is present;
Further comprising: a SIP detection module for detecting a SIP session in the 4G mobile communication network. 10. The method of claim 9,
A threshold value determiner for generating a detection message when S_count summation of the state list object for each subscriber terminal IP exceeds a threshold value h and performing time calculation for each Call ID object if the sum does not exceed the threshold value h;
Further comprising: a SIP detection module for detecting a SIP session in the 4G mobile communication network. 11. The method of claim 10,
The threshold value determination unit may determine,
And if the Start_time of the Call-ID is larger than the set value (S_time) with respect to the current time, the corresponding Call-ID is deleted. (a) transmitting a Session Initiation Protocol (SIP) request message from an access terminal to an IMS network providing a VoLTE service;
(b) transmitting a SIP response message in response to the SIP request message from the IMS (IP Multimedia subsystem) to the subscriber station through the IMS network; And
(c) receiving, by the SIP detecting device, the SIP response message for each subscriber terminal, accumulating the cumulative value of the response code of the SIP header included in the received SIP response message for each predetermined period of time by the subscriber terminal, And considering the SIP attack and the abnormal behavior when the cumulative value of the status list object for each subscriber terminal IP exceeds the threshold value,
The step (c)
If the response code (StatusCode) exists in the managed response code list, extracting the corresponding subscriber terminal IP from the IP extracting unit,
Determining whether the extracted subscriber station IP exists in a DetectSession list and a status list object, respectively,
Generating a DetectSession object of the subscriber station IP in the first class determiner if the subscriber station IP is not present in the DetectSession list; And
And if the subscriber station IP exists in the DetectSession list, determining by the second class determiner whether the subscriber station IP corresponding to the status list object exists,
The first class determiner may include a Call-ID List object that specifies a Call-ID, a CSCF IP, a Method Type, a count, and a start / detect time as attribute values as well as a Status-code, an S_count, And generating a DetectSession object in response to the SIP attack. delete delete delete delete The method of claim 12, wherein the step of determining whether the subscriber station IP exists includes:
Wherein if the subscriber station IP exists in the DetectSession list and there is no response code corresponding to the status list object, the second class determiner generates a state object in the SIP attack system and the abnormal detection Way. The method as claimed in claim 17, wherein the step of determining whether the subscriber station IP exists includes:
And the second class determination unit adds an attribute value according to a new response code to the state object. 13. The method of claim 12, wherein generating the DetectSession object of the subscriber station IP comprises:
Wherein if the subscriber station IP exists in the DetectSession list and there is a response code matching the status list object, the first class determiner increments the S_count and SIP Method type of the DetectSession object by 1 SIP attack and abnormal detection method. 20. The method of claim 19,
(d) If the corresponding Call-ID does not exist in the DetectSession object after incrementing the S_count and SIP Method types by 1, add CSCF IP, Method type, C_count and Start / Detect_time according to the Call-ID A third class determination unit for generating a Call-Id object and updating the CSCF IP, Method type, and Detect_time according to the corresponding Call-ID in the third class determination unit and increasing C_count by 1;
The method comprising the steps of: detecting a SIP attack and an abnormal state of the SIP detection system; (e) The method according to claim 20,
Generating a detection message when S_count summation of the state list object for each subscriber terminal IP exceeds a threshold value h, and if not, performing time calculation for each Call-ID object in a threshold value determiner;
The method comprising the steps of: detecting a SIP attack and an abnormal state of the SIP detection system; 22. The method of claim 21,
The step (e)
And if the Start_time of the Call-ID is larger than the set value (S_time) with respect to the current time, the threshold determining unit deletes the corresponding Call-ID.

Images