针对SIP协议的入侵检测关键技术的研究  

Research on Intrusion Detection of SIP protocol

作　　者：杨露[1] 王勇军[1] 赵文哲[1] 

机构地区：[1]国防科技大学计算机学院,湖南省长沙市410073

出　　处：《中国电子商情（通信市场）》2014年第1期43-47,共5页

摘　　要：VoIP通信技术已成为网络技术中的热门技术.在VoIP业务中,SIP协议用于建立、修改和终止IP网络上的双方或多方多媒体会话.SIP协议以其简易性、开放性、公用性和标准化等特点成为了IMS（IP Multimedia Subsystem,IP多媒体子系统）中的呼叫控制协议,但是,由于SIP协议的简易性、开放性、公用性、标准化和模块化,在一定程度上增加了攻击者攻击的简易程度.同时SIP服务主要作为一种基于TCP/IP技术的面向无连接的服务,不需要对源地址进行授权和认证,因此更容易遭受到恶意攻击者的攻击,本文主要针对SIP协议的安全性中的畸形信令报文检测,DoS攻击检测,SIP协议会话攻击检测提出了初步的研究方法,并给出了相应的防范措施,希望能够为SIP协议的安全性研究提供一定的参考.VolP communication technology has become a hot technology in network techn ology.In VolP business, SIP protocol is used to establish, modify and terminate multimedia session of the IP network.The SIP protocol with its characteristics of simplification, openn ess, public and standardization has become the control protocol of the IMS （IP Multimedi a Subsystem）.However,the SIP protocol is simple,open and standard,attacker can easiliy inv ade it.Meanwhile, the SIP service as a connectionless service based on TCP/IP technolog y, without the need for authorization and authentication of the source address,is more vulne rable by attacker. This paper proposes primary research on instrution detection of abnorma I SIP message, DOS attack and SIP protocol session attack,and gives corresponding prevent ive measures, hoping to provide some reference for the security of SIP protocol.

关 键 词：会话初始协议 入侵检测 畸形报文 DOS攻击 

分 类 号：TN915.04[电子电信—通信与信息系统]