“…Such capability can only be provided by self-learning components which capture characteristics of observed normal data to flag anomalies as malicious events. Such methods have been previously proposed for general-purpose intrusion detection systems for IP networks, e.g., [5,7,11,12,21]. The peculiarities of the network protocols used in IMS, e.g., the Session Initiation Protocol, necessitate the development of specialized intrusion detection techniques tailored to their semantics.…”