KR20100073535A - Detection apparatus for attack of malformed sip message and method thereof - Google Patents

Abstract

PURPOSE: An apparatus performing the detection of the sip variation control message is provided to minimize a wrong detection rate of SIP variation control message messaging attack. CONSTITUTION: A positive rule-based check block(210) checks a total message length, a maximum length by header and an available string in order to permit normal SIP control message accepting a SIP(Session Initiation Protocol) protocol standard. A negative rule-based check block(220) verifies the input value of the message based on the SIP attack signature defined by a security manager, in order to detect the attack only known an SIP mutative control message attack signature.

Description

Detecting apparatus for attack of malformed SIP message and method

The present invention uses a combination of a positive detection model that allows only normal SIP control messages conforming to the SIP standard protocol specification and a negative detection model that detects and blocks only known attacks based on SIP variant control message attack signatures. False detection rate of the message attack can be minimized, and a large number of SIP variant control message attacks can cause SIP call server, voice gateway, SBC equipment, IP phone terminal equipment and service paralysis or SQL injection through SQL code insertion. The present invention relates to a device and a method for detecting a SIP variant control message attack that can detect and block the same service abuse attack.

Internet telephone exchange equipment supporting SIP protocols such as conventional SBC, IP-PBX, SIP proxy server, and network security technologies such as IP-based IDS / IPS and web firewall such as web firewall, IPS, IDS, and the like. The Internet Attenuator does not provide SIP variant control message attack detection and blocking.In case of network security devices such as web firewall, IPS, IDS, and signature-based pattern matching, some of L3 ~ L7, HTTP, FTP, DNS, etc. Because it provides limited functions for deep packet analysis and detection for specific protocols, there is a limit to deep packet analysis and detection up to the SIP protocol, which is a call setup control protocol.

Therefore, by using a combination of positive detection model and negative detection model, the false positive detection rate of unknown SIP variant control message attack can be minimized, and SIP call server, voice gateway, SBC equipment, There is an urgent need for the development of devices and methods for detecting SIP variant control message attacks that can detect and block IP phone terminal equipment and service attacks or service misuse attacks such as SQL Injection through SQL code injection. It is true.

Accordingly, the present invention has been conceived to solve the above problems, a positive detection model that allows only normal SIP control messages conforming to the SIP standard protocol standard, and a negative detection model that detects and blocks only known attacks based on SIP variant control message attack signatures. It is an object of the present invention to provide an apparatus and a method for detecting a SIP variant control message attack that can minimize the false positive rate of unknown SIP variant control message attack by using a mixture of.

Another object of the present invention is to attack SIP call server, voice gateway, SBC equipment, IP telephone equipment and service through mass SIP variant control message attack, or service misuse attack such as SQL Injection through SQL Code insertion. An apparatus and method for detecting a SIP variant control message attack capable of detecting and blocking the present invention are provided.

In order to achieve the above object, an apparatus for detecting a SIP variant control message attack according to an embodiment of the present invention has a function of parsing a SIP control message by headers and subfields defined in a standard standard and is in violation of RFC 3261 format. To drop a message, check the first line, SIP header, SIP body, SIP header required field, SIP header field delimiter, SIP header name and value format, and save session state information in session state information table for each transaction. A SIP control message header parser module having a function of parsing a SIP header and a SIP body (SDP) with a name and a value and transmitting the same to a SIP variant control message detection module; A SIP variant control message attack detection module for detecting a SIP variant control message from information parsed from the SIP control message header parser module; A SIP session state information table for storing SIP session state information; Characterized in that it comprises a.

In the present invention, the SIP control message header parser module parses and constructs SIP First Line, SIP header, and SDP message in order and stores them in the session state information table, and drops the messages that violate RFC 3261 format. A parser section; A session state information table for storing transaction information and main header values of the SIP message parsed by the SIP message parser in a session state information table; Characterized in that it comprises a.

In the present invention, the SIP variant control message attack detection module is a positive rule-based check that checks the total length of the message, the maximum length of each header, the available string, etc. to allow only normal SIP control messages conforming to the SIP standard protocol standard. A block; A negative rule based detection block for verifying an input value of a message based on a SIP attack signature defined by a security manager to detect only an attack known as a SIP variant control message attack signature based; Characterized in that it comprises a.

In the present invention, the positive rule-based check block includes: a SIP string overflow checker for checking an overflow attack by checking a length of a SIP header field and a value of a parameter value, and checking a repetition number of the SIP header and a parameter; An abnormal user address checker that checks a format and a length of user addresses of Request URI, From, To, and Via; A SIP message permission string checker which checks whether a string other than the string defined in the standard RFC exists for each SIP header field; a SIP Integer range checker for checking whether a value of a via field port, a max-forward field, a content_length, a status code, etc. has a range of values defined in the standard; A SIP Version checker which checks whether the Version information of the SIP message matches the Version information defined in the standard RFC; A SIP Content-type checker which checks whether the Content-type information of the SIP message matches the Content-type information defined in the standard RFC; A SIP mandatory header field presence and repetition number checker which checks whether a required header field exists and repeats according to a method of a request message and a status code of a response message; A user-defined positive rule checker which checks whether the value of the SIP header field and the parameter field matches the rule specified by the user; A positive rule violation filtering unit for dropping SIP messages that violate the positive rules checked by eight inspection units of the positive rule based block, or delivering normal SIP messages to the negative rule based detection block; Characterized in that consisting of.

In the present invention, the negative rule-based detection block includes a SIP-based web attack type pattern detection unit for detecting a SIP-based web attack type pattern, such as SQL Injection, Cross Site Script attack; A malicious code attack pattern detector; A format string attack pattern detector; VoIP equipment O / S vulnerability pattern detection unit; A special character overflow attack pattern detector; A user-specified attack pattern detector for detecting an attack pattern designated by a user for detecting various other attacks; One negative rule-based packet filling unit for dropping SIP messages matching the negative rules detected by the six detection units or delivering normal SIP messages to a SIP server or a terminal; Characterized in that consisting of.

In addition, in the method for detecting a SIP variant control message attack according to an embodiment of the present invention for achieving the above object, the process of detecting through the SIP variant control message attack detection module is the first from the SIP control message header parser module When the line and SIP header information is received in the positive rule-based inspection block, and the SIP packet matches the positive allow rule, the SIP packet is sent to the negative rule-based detection block for matching of the negative detection rule, and the SIP packet matches the positive allow rule. If not, dropping the packet; When the SIP packet matches the negative detection rule by receiving the information in which the SIP packet matches the positive allow rule and the SDP information from the SIP control message header parser module by checking in the positive rule based inspection block, and receiving the SDP information from the negative rule based detection block, Drop and if the SIP packet does not match the negative detection rule, sending a normal SIP control message; .

Apparatus and method for detecting SIP variant control message attack according to the present invention have the following effects.

First, the present invention uses a combination of a positive detection model that allows only normal SIP control messages conforming to the SIP standard protocol specification, and a negative detection model that detects and blocks only attacks known as SIP variant control message attack signatures. False detection rate of variant control message attack can be minimized.

Second, the present invention is to attack the SIP call server, voice gateway, SBC equipment, IP phone terminal equipment and service paralysis through a large number of SIP variant control message attack, or service abuse attacks such as SQL Injection through SQL code insertion Can be detected and blocked.

Third, the present invention can detect and block SIP variant control messages that violate the RFC 3261 SIP protocol message standard.

Looking at the preferred embodiment of the present invention together with the accompanying drawings as follows, when it is determined that the detailed description of the known art or configuration related to the present invention may unnecessarily obscure the subject matter of the present invention The description will be omitted, and the following terms are terms defined in consideration of functions in the present invention, which may vary according to a user's or operator's intention or custom, and the definition is an apparatus for detecting an SIP variant control message attack according to the present invention. And the contents throughout this specification describing the method.

Hereinafter, an apparatus for detecting a SIP variant control message attack according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a structural diagram of a SIP control message for explaining a SIP control message parser module according to an embodiment of the present invention.

The SIP message is divided into a request and a response message and follows the following format.

SIP-message = Request / Response

Request = Request-Line

            * (message-header)

            CRLF

            [message-body]

Response = Status-Line

            * (message-header)

            CRLF

            [message-body]

First Line refers to Request-Line and Status-Line, SIP Method refers to INVITE, ACK, REGISTER, CANCEL, BYE, Status Code, etc. of First Line, SIP Header field refers to From, To, Via, CSeq, Call -ID and the like, and parameter filed refers to data that comes after the value of the SIP Header field. For example, the To field value is the address of the receiver and the parameter is a Tag.

2 is a diagram illustrating a configuration for explaining an apparatus for detecting a SIP variant control message attack according to an embodiment of the present invention.

Devices for detecting SIP variant control message attacks include SIP control message header parser module 100, SIP variant control message attack detection module 200, SIP session state information table 300, positive rule based inspection block 210, negative Rule-based detection block 220, and the like.

The SIP (Session Initiation Protocol) is a standard call setup protocol developed by the IETF for controlling the transmission of multimedia data such as voice and video, and the representative application service using the SIP protocol is Internet telephone (VoIP). It also includes based conferencing, voice mail, event notification, instant messaging, and more.

As shown in FIG. 2, the apparatus for detecting a SIP variant control message attack has a function of parsing a SIP control message by headers and subfields defined in the standard standard, and a name and a name for the SIP header and SIP body (SDP). a SIP control message header parser module having a function of parsing a value and transmitting the same to a SIP malformed message detection module; A SIP variant control message attack detection module for detecting a SIP variant control message from information parsed from the SIP control message header parser; A SIP session state information table for storing SIP session state information; It consists of.

Looking at the configuration and function of the technical means constituting the apparatus for detecting the SIP variant control message attack of the present invention as follows.

The SIP control message header parser module 100 parses a SIP control message by headers and subfields defined in the standard, and has a first line, a SIP header, and a SIP body to drop a message that violates the RFC 3261 format. SIP header field delimiter, SIP header name and value format check, session state information per transaction in the session state information table, SIP header and SIP Body (SDP) Parse by name and value and send to SIP variant control message detection module.

The SIP variant control message attack detection module 200 detects a SIP variant control message from information parsed from the SIP control message header parser module 100.

The SIP variant control message attack detection module 200 is a positive rule-based check block 210 for checking the total length of the message, the maximum length of each header, and the available strings to allow only normal SIP control messages conforming to the SIP standard protocol standard. )and; A negative rule based detection block 220 for verifying an input value of a message based on a SIP attack signature defined by a security manager to detect only an attack known as a SIP variant control message attack signature based; In the positive rule-based check block 210, the length of the SIP header field is checked, the length of the parameter value is checked, the number of repetitions of the SIP header and the parameter is checked, and each SIP header field is different from the string defined in the standard RFC. Checks whether a string exists, whether the via field port, max-forward field, content_length, status code, etc. have a value in the range defined in the standard, and the version information of the SIP message is defined in the standard RFC. Check whether the information matches the information, whether the content-type information of the SIP message matches the content-type information defined in the standard RFC, and whether there is a required header field according to the method of the request message and the status code of the response message, and the number of iterations. Checks, checks the format and length of the Request URI, From, To, Via user addresses, performs a user-defined positive rule check, and the negative ruler Detection block 220 detects SIP-based web attack type patterns such as SQL Injection and Cross Site Script attacks, malware attack pattern detection, format string attack pattern detection, VoIP device O / S vulnerability pattern detection, and special characters. To detect overflow attack patterns and various other attacks, it is possible to detect attack patterns specified by the user.

The SIP session state information table 300 stores SIP session state information. Here, as the session state information table 300, SIP header information, session state information, and the like are stored. Here, the session state information table is used for SIP session state based detection.

In the apparatus for detecting a SIP variant control message attack, as shown in FIG. 3, the positive rule-based check block includes a total of eight checkers and one filtering unit.

The SIP string overflow checker 211 checks the length of the value of the SIP header field and the length of the parameter value, and detects the overflow attack by checking the number of repetitions of the SIP header and the parameter.

The abnormal user address (URI) check unit 212 checks the format and length of the user addresses of Request URI, From, To, and Via. Here, the URI address of the SIP message is present in the format of username @ domain in the From, To, Via fields of the First Line and SIP header fields of the request message.

The SIP message permission string checking unit 213 checks whether a string other than the string defined in the standard RFC exists for each SIP header field. For example, the SIP message allowable string checker checks whether a character other than English and numbers is used for the SIP tag, user name, password, and host name.

The SIP Integer range checker 214 checks whether the values of the via field port, the max-forward field, the content_length, the status code, and the like have values in the range defined in the standard. For example, in case of Status Code, check whether it has a range of 100 ~ 699.

The SIP version checker 215 checks whether the version information of the SIP message matches the version information defined in the standard RFC.

The SIP Content-type Inspector 216 checks whether the Content-type information of the SIP message matches the Content-type information defined in the standard RFC.

SIP presence header field presence and repetition frequency check unit 217 checks the presence and repetition of the required header field in accordance with the method of the request message and the Status Code of the response message.

The user-defined positive rule checker 218 checks whether the value of the SIP header field and the parameter field matches the rule specified by the user.

The positive rule violation filtering unit 219 drops the SIP message that violates the positive rule checked by the eight inspection units of the positive rule based block, or delivers the normal SIP message to the negative rule based detection block.

In the apparatus for detecting a SIP variant control message attack as shown in FIG. 4, the negative rule-based detection block detects a SIP-based web attack type pattern that detects a SIP-based web attack type pattern such as SQL Injection and a Cross Site Script attack. A part 221; A malicious code attack pattern detector 222; A format string attack pattern detector 223; VoIP equipment O / S vulnerability pattern detection unit 224; A special character overflow attack pattern detector 225; A custom attack pattern detector 226 for detecting an attack pattern designated by a user for detecting various other attacks; A total of six detection units and one negative rule-based packet filtering unit 227 for dropping SIP messages matching the negative rules detected by the detection unit or delivering normal SIP messages to the SIP server or the terminal; It consists of.

5 is a flowchart illustrating a process of detecting through a SIP variant control message attack detection module in a method for detecting a SIP variant control message attack according to an embodiment of the present invention.

As shown in FIG. 5, in the method of detecting a SIP variant control message attack, a flow of detection through the SIP variant control message attack detection module is as follows.

First, the process of detecting the SIP variant control message attack detection module receives the first line and the SIP header information from the SIP control message header parser module 100 in the positive rule-based inspection block 210 and the SIP packet is applied to the positive allow rule. If there is a match, it is sent to the negative rule based detection block 220 to match the negative detection rule, and if the SIP packet does not match the positive allow rule, drop the packet. Thereafter, the positive rule-based check block 210 checks the SIP packet to match the positive allow rule and the SDP information from the SIP control message header parser module is received in the negative rule-based detection block 220 to detect the SIP packet negatively. If it matches the rule, drop the packet, and if the SIP packet does not match the negative detection rule, send a normal SIP control message. Here, SIP negative rule-based SIP variant control message detection detects attacks that exploit variant SIP control message, SIP Cross Site Script, SIP SQL Injection, malware insertion, Format String, special character overflow, VoIP equipment O / S vulnerability. It will include.

It will be appreciated by those skilled in the art that the present invention is not limited to the above embodiments, and that various modifications and changes can be made without departing from the spirit of the present invention.

1 is a diagram illustrating a SIP control message structure for explaining a SIP control message parser module according to an embodiment of the present invention.

2 is a diagram showing a configuration for explaining an apparatus for detecting a SIP variant control message attack according to an embodiment of the present invention.

FIG. 3 is a diagram illustrating a positive rule based inspection block constituting an apparatus for detecting a SIP variant control message attack according to an embodiment of the present invention. FIG.

4 is a diagram illustrating a negative rule based inspection block constituting an apparatus for detecting a SIP variant control message attack according to an embodiment of the present invention.

5 is a flowchart illustrating a process of detecting through a SIP variant control message attack detection module in a method for detecting a SIP variant control message attack according to an embodiment of the present invention.

<Code Description of Main Parts of Drawing>

100: SIP control message header parser module

200: SIP variant control message attack detection module

300: session state information table 210: positive rule-based check block

211: SIP string overflow checker 212: Unusual user address (URI) checker

213: SIP message allowed string checker 214: SIP Integer range checker

215: SIP Version Inspector 216: SIP Content-type Inspector

217: SIP mandatory header field presence and repeat count check unit

218: Custom positive rule checker 219: Positive rule violation filter

220: negative rule-based detection block 221: SIP-based web attack type pattern detection unit

222: malware attack pattern detection unit 223: format string attack pattern detection unit

224: VoIP equipment O / S vulnerability pattern detection unit

225: Special character overflow attack pattern detector

226: Custom attack pattern detector

227: negative rule-based packet filling unit

Claims (6)

A device for detecting a SIP variant control message attack, Parsing SIP control messages by header and subfields defined in the standard, and first line, SIP header, SIP body, SIP header required field, SIP header field delimiter in order to drop the message that violates RFC 3261 format. SIP header name and value format check, session state information per transaction in session state information table, SIP header and SIP Body (SDP) parsing by name and value to detect SIP variant control message A SIP control message header parser module having a function of transmitting to a module; A SIP variant control message attack detection module for detecting a SIP variant control message from information parsed from the SIP control message header parser module; A SIP session state information table for storing SIP session state information; Apparatus for detecting a SIP variant control message attack comprising a. The method of claim 1, The SIP control message header parser module parses and constructs a SIP First Line, a SIP header, and an SDP message in a session state information table, and drops a message that violates the RFC 3261 format; A session state information table for storing transaction information and main header values of the SIP message parsed by the SIP message parser in a session state information table; Apparatus for detecting a SIP variant control message attack comprising a. The method of claim 1, The SIP variant control message attack detection module includes: a positive rule-based check block for checking the total length of the message, the maximum length of each header, the available string, etc. to allow only normal SIP control messages conforming to the SIP standard protocol standard; A negative rule based detection block for verifying an input value of a message based on a SIP attack signature defined by a security manager to detect only an attack known as a SIP variant control message attack signature based; Device for detecting a SIP variant control message attack, characterized in that it comprises a. The method of claim 3, wherein The positive rule-based check block includes: a SIP string overflow checker that checks the length of a value and a parameter value of a SIP header field and detects an overflow attack by checking the number of repetitions of the SIP header and a parameter; An abnormal user address checker that checks a format and a length of user addresses of Request URI, From, To, and Via; A SIP message permission string checker which checks whether a string other than the string defined in the standard RFC exists for each SIP header field; a SIP Integer range checker for checking whether a value of a via field port, a max-forward field, a content_length, a status code, etc. has a range of values defined in the standard; A SIP Version checker which checks whether the Version information of the SIP message matches the Version information defined in the standard RFC; A SIP Content-type checker which checks whether the Content-type information of the SIP message matches the Content-type information defined in the standard RFC; A SIP mandatory header field presence and repetition number checker which checks whether a required header field exists and repeats according to a method of a request message and a status code of a response message; A user-defined positive rule checker which checks whether the value of the SIP header field and the parameter field matches the rule specified by the user; A positive rule violation filtering unit for dropping SIP messages that violate the positive rules checked by eight inspection units of the positive rule based block, or delivering normal SIP messages to the negative rule based detection block; Device for detecting a SIP variant control message attack, characterized in that consisting of. The method of claim 3, wherein The negative rule-based detection block includes a SIP-based web attack type pattern detection unit for detecting a SIP-based web attack type pattern such as SQL Injection and Cross Site Script attack; A malicious code attack pattern detector; A format string attack pattern detector; VoIP equipment O / S vulnerability pattern detection unit; A special character overflow attack pattern detector; A user-specified attack pattern detector for detecting an attack pattern designated by a user for detecting various other attacks; One negative rule-based packet filling unit for dropping SIP messages matching the negative rules detected by the six detection units or delivering normal SIP messages to a SIP server or a terminal; Device for detecting a SIP variant control message attack, characterized in that consisting of. A method for detecting a SIP variant control message attack, The detection process through the SIP variant control message attack detection module receives information from the SIP control message header parser module at the positive rule-based checker, and if the SIP packet matches the positive allow rule, the negative to confirm the match of the negative detection rule. Transmitting to the rule-based check unit and dropping the packet if the SIP packet does not match the positive permission rule; If the SIP rule receives negative information based on the negative rule based checker by checking the positive rule-based checker, and the SIP packet matches the negative detection rule, the packet is dropped and the SIP packet is negatively detected. If it does not match a rule, sending a normal SIP control message; SIP variant control message attack detection method comprising the.

Images