Session initiation protocol (SIP) distributed denial of service (DDoS) attack distributed defensive system and load balancing method thereof

Abstract

The invention relates to voice over IP (VoIP) network security and initiation protocol (IP) communication field, in particular to a session initiation protocol (SIP) distributed denial of service (DDoS) attack distributed defensive system and a load balancing method thereof. The SIP DDoS attack distributed defensive system comprises defence detection nodes and a load balancer. The defence detection nodes are connected with the load balancer and are used for circulating load information to the load balancer timely to share a rule base. The load balancer is connected with a plurality of defence detection nodes, is used for sending SIP information to each defence detection node, and updating a defence node balance sheet according to the load information sent by the defence detection nodes. By the adoption of distributed structure, higher information processing ability and better expandability are achieved. Higher attack detection rate and lower false alarm rate are achieved based on the detecting algorithm load balancing method. Load balancing features of each node is achieved by using a load distribution algorithm.

Description

technical field [0001] The invention relates to the fields of VoIP network security and IP communication, in particular to a SIP DDoS attack distributed defense system and a load balancing method thereof. Background technique [0002] With the diversification of people's communication needs, the scope of IP communication has been greatly expanded, and it has begun to evolve from a simple VoIP system (Voice Over IP) to a unified communication (EoIP, Everything Over IP). SIP (session initiation protocol, a signaling control protocol at the application layer) is used to establish, modify and terminate two-party or multi-party multimedia sessions on the IP network. It has become the core protocol of VoIP, IMS, and IPTV because of its simple structure and convenient use. SIP is also used in the NGN architecture defined by ETSI and ITU-T. At the beginning of the design, the SIP protocol fully considered the ease of use and flexibility of the protocol, and did not focus on securit...

AI Technical Summary

Problems solved by technology

A system that achieves defense by limiting the message request rate cannot distinguish between normal messages and attack messages, and can only weaken the attack intensity; the defense efficiency of the state firewall system on the SIP network depends on the set security rules, and can only defend against known attacks; flow-based Since the distributed defense system does not consider the characteristics of SIP messages, most of the detection algorithms cannot be used and high false positives and false negatives will be generated; the self-defense system of the SIP proxy server is embedded in the SIP proxy server, which increases the processing burden, which can cause the server to crash in the face of a large number of attack messages

[0005] None of the existing SIP DDoS defense models can achieve active and proactive detection of unknown attacks while effectively defending

At the same time, some main SIP DDoS attack detection algorithms, such as the cumulative sum algorithm and the detection method based on the SIP transaction state machine, etc., have high detection accuracy, but due to the large consumption of resources and slow detection speed, etc. Cannot be used for defense in the defense system

Images