Classification of SIP messages by a syntax filter and SVMs

Abstract

Abstract-The Session Initiation Protocol (SIP) is at the root of many sessions-based applications such as VoIP and media streaming that are used by a growing number of users and organizations. The increase of the availability and use of such applications calls for careful attention to the possibility of transferring malformed, incorrect, or malicious SIP messages as they can cause problems ranging from relatively innocuous disturbances to full blown attacks and frauds. To this end, SIP messages are analyzed to be classified as "good" or "bad" depending on whether this structure and content are deemed acceptable or not. This paper presents a classifier of SIP messages based on a two stage filter. The first stage uses a straightforward lexical analyzer to detect and remove all messages that are lexically incorrect with reference to the grammar that is defined by the protocol standard. The second stage uses a machine learning approach based on a Support Vector Machine (SVM) to analyze the structure of the remaining syntactically correct messages in order to detect semantic anomalies which are deemed a strong indication of a possibly malicious message. The SVM "learns" the structure of the "good" and "bad" SIP messages through an initial training phase and the SVM thus configured correctly classifies messages produced by a synthetic generator and also "real" SIP messages that have been collected from the communication network at our institution. The preliminary results of such classification look very promising and are presented in the final section of this paper.

On-the-fly traffic classification and control with a stateful SDN approach

“…The definition of the signatures and matching rules implemented by above approaches can be either achieved manually, i.e., by studying or reverse-engineering the protocols to classify, or, automatically, i.e., by adopting Machine Learning (ML). ML learns the peculiar features of given traffic flows, and provides the knowledge to classify on-the-fly the traffic [7]. The disadvantage is that the results depend mostly on the training data which should be up-to-date and accurate, and may not be as accurate as other techniques.…”

Performance Comparison of Parallel Execution Using GPU and CPU in SVM Training Session

“…Support Vector Machine (SVM) is a machine learning approach [1] [2], which is used in a growing number of applications. SVM is a useful technique for data classification [3].…”

Ανίχνευση Και Πρόληψη Επιθέσεων Άρνησης Εξυπηρέτησης Στα Πρωτόκολλα SIP Και SDP

“…Almost seven years ago, Ferdous researched the area of anomalous messages in SIP networks [137]. The authors offered a two-tier system to cope with malformed messages.…”