Abnormal Signaling SIP Dialogs Detection based on Deep Learning

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

Abstract

The detection of abnormal sequences of SIP messages in real-time is crucial to avoid SIP signaling-based attacks. In this paper, we propose a deep learning approach to detect signaling patterns of multimedia sessions established with the Session Initiation Protocol (SIP). The approach is based on a recurrent neural network (RNN). We study the performance of different Long Short-term Memory (LSTM) RNN architectures, which are trained using a SIP signaling dataset of trustworthy SIP dialogs captured by a SIP server. The trained RNNs are then used to detect the SIP dialogs in real-time. After characterizing the dataset adopted for the training, validation, and testing, we present the experimental results obtained for the different RNN architectures, showing that the classification probability of trustworthy SIP dialogs exceeds 93% in the test stage. Finally, we present two methodologies to detect abnormal SIP dialogs, i.e., not contained in the trustworthy training dataset. After a detailed analysis of the skewness and kurtosis computed with the numerical RNN outputs, we show that they can be used as classification features. The first method is based on a K-means unsupervised classifier, while the second one is based on a semi-supervised threshold-based classifier. Experimental results show that the threshold-based classifier achieves 99.45% of detection probability, showing the effective utility of the proposed methodology to detect abnormal SIP sequences in a short period of time.

Original languageEnglish
Title of host publication2021 IEEE 93rd Vehicular Technology Conference, VTC 2021-Spring - Proceedings
PublisherInstitute of Electrical and Electronics Engineers Inc.
ISBN (Electronic)9781728189642
DOIs
Publication statusPublished - Apr 2021
Event93rd IEEE Vehicular Technology Conference, VTC 2021-Spring - Virtual, Online
Duration: 25 Apr 202128 Apr 2021

Publication series

NameIEEE Vehicular Technology Conference
PublisherInstitute of Electrical and Electronics Engineers Inc.
Volume2021-April
ISSN (Print)1550-2252

Conference

Conference93rd IEEE Vehicular Technology Conference, VTC 2021-Spring
CityVirtual, Online
Period25/04/2128/04/21

Keywords

  • Deep Learning
  • Recurrent Neural Networks
  • Session Initiation Protocol

Fingerprint

Dive into the research topics of 'Abnormal Signaling SIP Dialogs Detection based on Deep Learning'. Together they form a unique fingerprint.

Cite this