PASCAL - Pattern Analysis, Statistical Modelling and Computational Learning

A Self-Learning System for Detection of Anomalous SIP Messages
Konrad Rieck, Stefan Wahl, Pavel Laskov, Peter Domschitz and Klaus-Robert Müller
Principles, Systems and Applications of IP Telecommunications (IPTCOMM) 2008.


Current Voice-over-IP infrastructures lack defenses against unexpected network threats, such as zero-day exploits and computer worms. The possibility of such threats originates from the ongoing convergence of telecommunication and IP network infrastructures. As a countermeasure, we propose a self-learning system for detection of unknown and novel attacks in the Session Initiation Protocol (SIP). The system identifies anomalous content by embedding SIP messages to a feature space and determining deviation from a model of normality. The system adapts to network changes by automatically retraining itself while being hardened against targeted manipulations. Experiments conducted with realistic SIP traffic demonstrate the high detection performance of the proposed system at low false-positive rates.

PDF - Requires Adobe Acrobat Reader or other PDF viewer.
EPrint Type:Article
Project Keyword:Project Keyword UNSPECIFIED
Subjects:Information Retrieval & Textual Information Access
ID Code:4172
Deposited By:Konrad Rieck
Deposited On:09 October 2008