Diameter flooding attack detection device and method

Abstract

The invention belongs to the technical field of communication security, in particular to a Diameter flooding attack detection device and method, The device comprises a parameter extracting module, which is used for extracting the signaling message parameters flowing through the signaling, and matching the state machine according to the parameters, wherein the signaling message parameters include the session identification parameters, the source host parameters and the user name parameters, and setting and initializing each signaling message parameter counter, a signaling flow analysis module which is used for early warning analysis of the signaling message parameters in the signaling according to the state machine matching condition and using the counter count value, a detection alarm module which is used for flooding attack alarm according to the warning analysis result of the signaling message parameters. The invention is applicable to an IMS network in a mobile communication network, security detection and early warning of Diameter flooding attacks are implemented, Automatic identification and detection of Diameter flooding attacks are performed based on IMS signaling flows, detection and early warning of Diameter flooding attacks are detected and early warned from signaling flows, thus improving IMS network security and having important guiding significance for the securityof communication networks.

Description

technical field [0001] The invention belongs to the technical field of communication security, and in particular relates to a Diameter flood attack detection device and method, which can be applied to an IMS network in a mobile communication network, and realize safety detection and early warning of Diameter flood attacks. Background technique [0002] IMS (IP Multimedia Subsystem) is a network architecture that provides voice and multimedia services based on IP networks. IMS can realize the integration of fixed user services, mobile user services and Internet services, and multimedia services such as voice, data, and video. It is the core technology of the next-generation network. [0003] In the IMS network architecture, the HSS (Home Subscriber Server, Home Subscriber Server) is an important data center for users in the network, and is responsible for authentication and authentication of all users. The Diameter protocol is the main protocol for interaction between the HS...

AI Technical Summary

Problems solved by technology

Therefore, it is more vulnerable to various forms of network attacks, especially flooding attacks using the Diameter protocol

Diameter flooding attack aims to use a large number of Diameter signaling to send to key network element entities such as HSS / CSCF, occupying its services and network resources, and then reducing the service capability of related network elements or even denying service

Images