基于Map-Reduce模型的畸形SIP消息检测方法  

Detection of Malformed SIP Messages Based on Map-Reduce Model

作　　者：双锴[1] 夏千林 

机构地区：[1]北京邮电大学网络与交换技术国家重点实验室,北京100876

出　　处：《北京邮电大学学报》2014年第6期11-16,共6页Journal of Beijing University of Posts and Telecommunications

基　　金：北京邮电大学青年科研创新计划专项项目(2013RC1102);国家重点基础研究发展计划(973计划)项目(2011CB302506);国家自然科学基金项目(61170274)

摘　　要：提出一种支持检测规则动态更新的畸形会话发起协议(SIP)消息检测模型,采用正向规则和反向规则结合的方式,以有效应对未知类型的畸形攻击.采用Map-Reduce模型实现检测规则,检测过程分为常规检测和特殊检测,常规检测阶段检测消息的基本格式,特殊检测阶段将SIP消息分割后并行检测语法规则.实验结果表明,提出的检测模型能准确高效地检测出SIP消息中的畸形特征.This paper proposed a session initiation protocol（ SIP） message inspection model combining the forward and backward rules inspection. With the capability of updating rules dynamically,this model can detect unknown type of malformed attack efficiently. Based on Map-Reduce model,the inspection procedure is divided into two phases： routine inspection and special inspection. In routine inspection,the basic format of SIP message is detected. In special inspection,the consistency with the grammar rules is verified in parallel after the segmentation of the SIP message. Experimental results show that the proposed inspection model can detect malformed features in the SIP message efficiently and accurately.

关 键 词：畸形会话发起协议消息 检测模型 Map-Reduce模型 

分 类 号：TN919.85[电子电信—通信与信息系统]