Detection of Abnormal SIP Signaling Patterns: A Deep Learning Comparison

Abstract

This paper investigates the detection of abnormal sequences of signaling packets purposely generated to perpetuate signaling-based attacks in computer networks. The problem is studied for the Session Initiation Protocol (SIP) using a dataset of signaling packets exchanged by multiple end-users. A sequence of SIP messages never observed before can indicate possible exploitation of a vulnerability and its detection or prediction is of high importance to avoid security attacks due to unknown abnormal SIP dialogs. The paper starts to briefly characterize the adopted dataset and introduces multiple definitions to detail how the deep learning-based approach is adopted to detect possible attacks. The proposed solution is based on a convolutional neural network capable of exploring the definition of an orthogonal space representing the SIP dialogs. The space is then used to train the neural network model to classify the type of SIP dialog according to a sequence of SIP packets prior observed. The classifier of unknown SIP dialogs relies on the statistical properties of the supervised learning of known SIP dialogs. Experimental results are presented to assess the solution in terms of SIP dialogs prediction, unknown SIP dialogs detection, and computational performance, demonstrating the usefulness of the proposed methodology to rapidly detect signaling-based attacks.

SIP-DDoS: SIP Framework for DDoS Intrusion Detection Based on Recurrent Neural Networks

“…They compared their methods to a probabilistic-based solution and found that their methods achieved higher detection scores in a shorter time. Extension [16] have been proposed for signaling SIP attacks based on Convolutional Neural Networks (CNN) architecture. The performance evaluation demonstrates that both the CNN and LSTM models achieve similar effectiveness in detecting the most probable SIP dialog identifier.…”

“…In this paper, we propose a comprehensive framework specifically designed to detect SIP INVITE flooding attacks. Recent approaches to detecting SIP-DDoS attacks focus mainly on analyzing the content of SIP messages or the entire SIP dialog [14,16]. However, these works have not been studied to analyze SIP traffic in time intervals.…”

Detecting SPIT Attacks in VoIP Networks Using Convolutional Autoencoders: A Deep Learning Approach

“…Oliveira et al [17] proposed a framework to detect malicious SIP calls. The first stage of this framework was built using a deep Convolution Neural Network (CNN) [18].…”