A self-learning system for detection of anomalous SIP messages

Konrad Rieck, Stefan Wahl, Pavel Laskov, Peter Domschitz, Klaus Muller

Research output: Chapter in Book/Report/Conference proceedingConference contribution

27 Citations (Scopus)

Abstract

Current Voice-over-IP infrastructures lack defenses against unexpected network threats, such as zero-day exploits and computer worms. The possibility of such threats originates from the ongoing convergence of telecommunication and IP network infrastructures. As a countermeasure, we propose a self-learning system for detection of unknown and novel attacks in the Session Initiation Protocol (SIP). The system identifies anomalous content by embedding SIP messages to a feature space and determining deviation from a model of normality. The system adapts to network changes by automatically retraining itself while being hardened against targeted manipulations. Experiments conducted with realistic SIP traffic demonstrate the high detection performance of the proposed system at low false-positive rates.

Original languageEnglish
Title of host publicationLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Pages90-106
Number of pages17
Volume5310 LNCS
DOIs
Publication statusPublished - 2008 Dec 15
Externally publishedYes
Event2nd International Conference on Principles, Systems and Applications of IP Telecommunications, IPTComm 2008 - Heidelberg, Germany
Duration: 2008 Jul 12008 Jul 2

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume5310 LNCS
ISSN (Print)03029743
ISSN (Electronic)16113349

Other

Other2nd International Conference on Principles, Systems and Applications of IP Telecommunications, IPTComm 2008
CountryGermany
CityHeidelberg
Period08/7/108/7/2

    Fingerprint

ASJC Scopus subject areas

  • Computer Science(all)
  • Theoretical Computer Science

Cite this

Rieck, K., Wahl, S., Laskov, P., Domschitz, P., & Muller, K. (2008). A self-learning system for detection of anomalous SIP messages. In Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) (Vol. 5310 LNCS, pp. 90-106). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 5310 LNCS). https://doi.org/10.1007/978-3-540-89054-6-5