|
A Self-Learning System for Detection of Anomalous SIP Messages
Konrad Rieck, Stefan Wahl, Pavel Laskov, Peter Domschitz and Klaus-Robert Müller
Principles, Systems and Applications of IP Telecommunications (IPTCOMM)
2008.
Abstract Current Voice-over-IP infrastructures lack defenses against
unexpected network threats, such as zero-day exploits and computer
worms. The possibility of such threats originates from the ongoing
convergence of telecommunication and IP network infrastructures. As
a countermeasure, we propose a self-learning system for detection of
unknown and novel attacks in the Session Initiation Protocol
(SIP). The system identifies anomalous content by embedding SIP
messages to a feature space and determining deviation from a model
of normality. The system adapts to network changes by automatically
retraining itself while being hardened against targeted
manipulations. Experiments conducted with realistic SIP traffic
demonstrate the high detection performance of the proposed system at
low false-positive rates. [Edit]
|
