A self learning model for detecting SIP malformed message attacks

Aziz, Sohail; Gul, Mehroz

doi:10.1109/icbnmt.2010.5705189

Cited by 3 publications

(3 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…From Theorem 1, we know that by utilizing the historical data, attackers can continuously falsify other legal states by bad data injection satisfying (4). During the continuous attacks, the controller considers that Path 1 is executed; however, the actual situation is shown in Path 3.…”

Section: • Inject Continuously Bad Datamentioning

confidence: 99%

“…Efficient and convenient management can be achieved by adopting cyber systems. However, there exist many vulnerabilities in cyber systems, like malformed message attacks [2][3][4] and denial of service attacks [5]. Therefore, for modern cyber-physical systems (CPSs), many new vulnerabilities from cyberspace have been exposed, and consequently, security has been a crucial factor for these modern CPSs.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Advanced Bad Data Injection Attack and Its Migration in Cyber-Physical Systems

Deng

Yang²,

Xun

et al. 2019

Electronics

View full text Add to dashboard Cite

False data injection (FDI) attack is a hot topic in cyber-physical systems (CPSs). Attackers inject bad data into sensors or return false data to the controller to cause the inaccurate state estimation. Although there exists many detection approaches, such as bad data detector (BDD), sequence pattern mining, and machine learning methods, a smart attacker still can inject perfectly false data to go undetected. In this paper, we focus on the advanced false data injection (AFDI) attack and its detection method. An AFDI attack refers to the attack where a malicious entity accurately and successively changes sensory data, making the normal system state continuously evaluated as other legal system states, causing wrong outflow of controllers. The attack can lead to an automatic and long-term system failure/performance degradation. We first depict the AFDI attack model and analyze limitations of existing detectors for detecting AFDI. Second, we develop an approach based on machine learning, which utilizes the k-Nearest Neighbor (KNN) technique and heterogeneous data including sensory data and system commands to implement a classifier for detecting AFDI attacks. Finally, simulation experiments are given to demonstrate AFDI attack impact and the effectiveness of the proposed method for detecting AFDI attacks.

show abstract

Section: • Inject Continuously Bad Datamentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Advanced Bad Data Injection Attack and Its Migration in Cyber-Physical Systems

Deng

Yang²,

Xun

et al. 2019

Electronics

View full text Add to dashboard Cite

show abstract

“…Sohail Aziz et al and Konrad Rieck, et al all proposed a self learning model for detecting SIP malformed message attacks [9] [10]. However, the self-learning-based methods are not practical enough due to high rate of false positive and false negative.…”

Section: Background and Related Workmentioning

confidence: 99%

A Method for Disguising Malformed SIP Messages to Evade SIP IDS

Wang¹,

Wang²

2013

JSW

View full text Add to dashboard Cite

RFC 3261 constrained several SIP header fields whose grammar contains the "name-addr / addr-spec" alternative to use name-addr when certain characters appear. Unfortunately, it expressed the constraints with prose copied into each header field definition, and at least one header field was missed. Further, the constraint has not been copied into documents defining extension headers whose grammar contains the alternative. This document updates RFC 3261 to state the constraint generically and clarifies that the constraint applies to all SIP header fields where there is a choice between using name-addr or addr-spec. It also updates the RFCs that define extension SIP header fields using the alternative to clarify that the constraint applies (RFCs 3325, 3515, 3892, 4508, 5002, 5318, 5360, and 5502)

show abstract

Detecting VoIP fuzzing attacks by using a honeypot system

Kilinc¹,

Cagal²

2017

2017 25th Signal Processing and Communications Applications Conference (SIU)

View full text Add to dashboard Cite

A self learning model for detecting SIP malformed message attacks

Cited by 3 publications

References 3 publications

Advanced Bad Data Injection Attack and Its Migration in Cyber-Physical Systems

Advanced Bad Data Injection Attack and Its Migration in Cyber-Physical Systems

A Method for Disguising Malformed SIP Messages to Evade SIP IDS

Detecting VoIP fuzzing attacks by using a honeypot system

Contact Info

Product

Resources

About