Voice over IP (VoIP) SIP Peering Use Cases

This paper investigates the detection of abnormal sequences of signaling packets purposely generated to perpetuate signaling-based attacks in computer networks. The problem is studied for the Session Initiation Protocol (SIP) using a dataset of signaling packets exchanged by multiple end-users. The paper starts to briefly characterize the adopted dataset and introduces a few definitions to propose a deep learning-based approach to detect possible attacks. The solution is based on the definition of an orthogonal space capable of representing the sampling space for each time step, which is then used to train a recurrent neural network to classify the type of SIP dialog for the sequence of packets observed so far. When a sequence of observed SIP messages is unknown, this represents possible exploitation of a vulnerability and in that case, it should be classified accordingly. The proposed classifier is based on supervised learning of two different sets of anomalous and non-anomalous sequences, which is then tested to identify the detection performance of unknown SIP sequences. Experimental results are presented to assess the proposed solution, which validates the proposed approach to rapidly detect signaling-based attacks.

show abstract

Classification of Abnormal Signaling SIP Dialogs Through Deep Learning

Pereira¹,

Oliveira

Kim

2021

IEEE Access

View full text Add to dashboard Cite

Due to the high utilization of the Session Initiation Protocol (SIP) in the signaling of cellular networks and voice over IP multimedia systems, the avoidance of security vulnerabilities in SIP systems is a major aspect to assure that the operators can reach satisfactory readiness levels of service. This work is focused on the detection and prediction of abnormal signaling SIP dialogs as they evolve. Abnormal dialogs include two classes: the ones observed so far and thus labeled as abnormal and already known, but also the unknown ones, i.e., specific sequences of SIP messages there were never observed before. Taking advantage of recent advances in deep learning, we use Long Short-Term Memory (LSTM) recurrent neural networks (RNNs) to detect and predict dialogs already observed before. Additionally, and based on the outputs of the LSTM neural network, we propose two different classifiers capable of identifying unknown SIP dialogs, given the high level of vulnerability they may represent for the SIP operation. The proposed approaches achieve higher SIP dialogs detection scores in a shorter time when compared to a reference probabilisticbased approach. Moreover, the proposed detectors of unknown SIP dialogs achieve a detection probability above 94%, indicating its capability to detect a significant number of unknown SIP dialogs in a short amount of time.

show abstract

Voice over IP (VoIP) SIP Peering Use Cases

Cited by 7 publications

References 5 publications

References

References

Detection of Signaling Vulnerabilities in Session Initiation Protocol

Classification of Abnormal Signaling SIP Dialogs Through Deep Learning

Contact Info

Product

Resources

About