Detection of Signaling Vulnerabilities in Session Initiation Protocol

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

Abstract

This paper investigates the detection of abnormal sequences of signaling packets purposely generated to perpetuate signaling-based attacks in computer networks. The problem is studied for the Session Initiation Protocol (SIP) using a dataset of signaling packets exchanged by multiple end-users. The paper starts to briefly characterize the adopted dataset and introduces a few definitions to propose a deep learning-based approach to detect possible attacks. The solution is based on the definition of an orthogonal space capable of representing the sampling space for each time step, which is then used to train a recurrent neural network to classify the type of SIP dialog for the sequence of packets observed so far. When a sequence of observed SIP messages is unknown, this represents possible exploitation of a vulnerability and in that case, it should be classified accordingly. The proposed classifier is based on supervised learning of two different sets of anomalous and non-anomalous sequences, which is then tested to identify the detection performance of unknown SIP sequences. Experimental results are presented to assess the proposed solution, which validates the proposed approach to rapidly detect signaling-based attacks.

Original languageEnglish
Title of host publicationTechnological Innovation for Applied AI Systems - 12th IFIP WG 5.5/SOCOLNET Advanced Doctoral Conference on Computing, Electrical and Industrial Systems, DoCEIS 2021, Proceedings
EditorsLuis M. Camarinha-Matos, Pedro Ferreira, Guilherme Brito
Place of PublicationCham
PublisherSpringer
Pages209-217
Number of pages9
ISBN (Electronic)978-3-030-78288-7
ISBN (Print)978-3-030-78287-0
DOIs
Publication statusPublished - 2021
Event12th IFIP WG 5.5/SOCOLNET Advanced Doctoral Conference on Computing, Electrical and Industrial Systems, DoCEIS 2021 - Virtual, Online
Duration: 7 Jul 20219 Jul 2021

Publication series

NameIFIP Advances in Information and Communication Technology
PublisherSpringer
Volume626
ISSN (Print)1868-4238
ISSN (Electronic)1868-422X

Conference

Conference12th IFIP WG 5.5/SOCOLNET Advanced Doctoral Conference on Computing, Electrical and Industrial Systems, DoCEIS 2021
CityVirtual, Online
Period7/07/219/07/21

Keywords

  • Deep learning
  • Multimedia networks
  • SIP protocol

Fingerprint

Dive into the research topics of 'Detection of Signaling Vulnerabilities in Session Initiation Protocol'. Together they form a unique fingerprint.

Cite this