基于状态机的流媒体入侵检测研究  

Stream Media Intrusion Detection through Interacting Protocol State Machines

作　　者：刘焱[1] 钟国辉[1] 刘玉[1] 王芙蓉[1] 

机构地区：[1]华中科技大学电子信息与工程系,武汉430074

出　　处：《计算机科学》2009年第5期108-110,共3页Computer Science

基　　金：国家自然科学基金(项目批准号:60502023)资助

摘　　要：提出了一种针对流媒体的入侵检测技术。对基于RTSP协议的流媒体应用经常遭受的诸如SETUP泛洪攻击、会话截取攻击、恶意结束流媒体会话攻击和恶意RTP攻击进行了建模。在状态迁移分析和应用层会话管理技术的基础上,利用已有的进攻模型,进行入侵检测。该技术可以有效检测上述攻击。对系统的入侵检测性能进行了建模,定量分析了该入侵检测系统的性能。分析表明,该系统有很短的入侵检测延时。This paper proposed a novel model to cope with these attacks such as SETUP flooding, session intercepting, malicious terminating stream media session and RTP assorting in stream media application based on RTSP protocol. The analysis in this paper was discussed in a particular assorting model in which the technology RTSPSTAT （RTSP Network State Transition Analysis Tool） was proposed based on state transmission analyzing and session management in application layer. In addition, the performance of this new model was quantitatively evaluated. The experiment result data show the processing method works well, specially characterized by fairly short delay of intruding detection.

关 键 词：流媒体 入侵检测系统 实时流协议 状态迁移分析 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]