基于扩展状态机的SIP洪泛攻击自适应检测  

Self-adaptive Detection for SIP Flooding Attacks Based on Extended State Machine

作　　者：谢晓龙[1] 季新生[1] 刘彩霞[1] 刘树新[1] 

机构地区：[1]国家数字交换系统工程技术研究中心,郑州450002

出　　处：《计算机工程》2012年第23期10-14,共5页Computer Engineering

基　　金：国家"863"计划基金资助项目(2011AA010604;2008AA011003)

摘　　要：IP多媒体子系统(IMS)中现有的会话初始协议(SIP)洪泛检测方法不能根据网络状况进行自适应检测。针对该问题,提出一种基于扩展状态机的SIP洪泛自适应检测方法。通过增加描述网络受到攻击或出现异常时的状态,构造IMS网络中的SIP扩展状态机,基于卡尔曼滤波设计自适应阈值调整算法,对SIP洪泛攻击进行自适应检测。实验结果表明,该方法比固定阈值的检测方法具有更好的检测性能,更适用于真实网络。In order to solve the problem that recent researches on detection of Session Initiation Protocol（SIP） flooding attacks in IP Multimedia Subsystem（IMS） can not adapt the network environment,this paper puts forward a self-adaptive detection method for SIP flooding attacks based on extended state machine.It builds the extended SIP state machine according to adding a state which described that the network is being attacked or abnormal,then adaptive adjusts the threshold through the introduction of adaptive algorithm based on Kalman filtering.Experimental results prove that this method has better detection performance than detection methods using fixed threshold,and it is more available in the real network.

关 键 词：IP多媒体子系统 会话初始协议 洪泛攻击 状态机 卡尔曼滤波 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]