SIP-DoS attack detection method, system and device based on traffic statistical characteristics and storage medium

Abstract

The invention relates to an SIP-DoS attack detection method, system and device based on traffic statistical characteristics and a storage medium. The attack detection method comprises the following steps: capturing VoIP call traffic; screening and analyzing the VoIP call flow in the captured flow; initializing the maximum packet speed of the theoretical SIP network; monitoring and calculating each key parameter in each sampling period and the whole statistical period; calculating and updating four threat detection key thresholds based on a self-learning method; determining an attack alarm weight corresponding to the IP; calculating an accumulated attack alarm value of each IP based on a weighted voting method weight; and warning information containing related attack source information is output to the terminal, and SIP-DoS attack traffic real-time detection is completed. The method has good real-time abnormal flow detection capability and detection accuracy.

Description

Technical Field

[0001] The present invention relates to the technical field of digital information transmission, and in particular to a SIP-DoS attack detection method, system, device and storage medium based on traffic statistical characteristics. Background Art

[0002] VoIP (Voice over IP) is a technology that uses the IP protocol to transmit voice data to provide call services. Compared with the traditional PSTN (Public Switched Telephone Network)-based voice calls, modern VoIP technology provides service providers with stronger functional selectivity and scalability while ensuring the same level of reliability, availability and security, and can effectively reduce the construction and maintenance costs of communication services. With the continuous development of domestic Internet infrastructure in recent years and the continuous increase in domestic enterprises' investment in service informatization and intelligence, VoIP is gradually becoming the preferred technology for enterprises to build call platforms and provide customers with high-quality services.

[0003] SIP (Session Initiation Protocol) is a standard protocol in the VoIP technical specification. The SIP protocol runs at the application layer and uses text to transmit protocol information. It is often used to create, modify, and release sessions involving one or more participants. Compared with other session control protocols such as H.323, the SIP protocol has the advantages of being flexible, easy to debug, and easy to expand, and is widely used in many VoIP deployment instances.

[0004] When the SIP protocol was first designed, it was not considered that it might be exploited or damaged by someone with intent. However, with the continuous development of VoIP technology, the security threats faced by the SIP protocol are also increasing. One of the most common and threatening attacks is the DoS (Denial of Service) attack. A DoS attack is an attack in which the attacker intentionally consumes the network resources or system resources of the target server through large-scale requests; or exploits protocol vulnerabilities to cause program buffer overflow errors, ultimately destroying the target system's ability to provide normal services to users. DoS attacks on SIP against VoIP service systems running on the SIP protocol can be divided into the following types:

[0005] SIP-Flood attack: The attacker sends a large number of SIP request packets to the target, occupying the target system resources so that it cannot process normal SIP requests from other users, and ultimately destroying the system communication function;

[0006] Call hijacking attack: During a call, the attacker sends a forged BYE or CANCEL request to both parties of the call, interfering with or destroying the normal conversation.

[0007] SIP malformed message attack: The attacker sends messages that do not conform to the SIP protocol specifications to the target, exploiting the SIP protocol vulnerabilities to disrupt the normal operation of the call platform system;

[0008] SIP address forgery attack: The attacker occupies the target system's voice and system resources by sending SIP request messages with forged source / destination IP addresses to the target. This method can bypass the IP interception mechanism, while occupying more server resources and generating larger reflected traffic to damage other systems.

[0009] At present, researchers at home and abroad have focused on the abnormal traffic detection methods in SIP-based networks, especially DoS attacks. According to the attack principle, they can be mainly divided into three types of detection methods:

[0010] Abnormal traffic detection method based on behavioral characteristics: Analyze and extract behavioral characteristic information from network data flow, and compare it with the normal traffic model to determine whether the traffic is normal. For example, Korean patent KR101095878B1 uses hidden Markov model to analyze and calculate the probability of abnormal behavior in the session, and uses the SIP normal model and the behavior sequence generated during the pre-training process to update the model; another example is US patent US7814547B2, which analyzes the traffic tracking session event history record, matches it with the known abnormal behavior rule library, and generates corresponding alarm information. In practical applications, due to the limited types of known attacks in the current network, this method has the problem of missing detection of unexplored network attack methods, making it difficult to achieve good results when applied to SIP-DoS attack traffic detection.

[0011] Abnormal traffic detection method based on statistical analysis theory: Use network traffic characteristic parameters to construct traffic level behavior patterns, compare the current traffic behavior characteristics with the traffic behavior patterns under normal circumstances based on real-time statistics, and complete abnormal attack traffic detection through comparison results. For example, Chinese patent CN115514518A, by statistically analyzing the characteristic distribution of SIP session data packets, determines whether the corresponding session is threatened; another example is Chinese patent CN102546524A, which extracts and calculates the card-square traffic monitor of SIP message distribution stability by monitoring network traffic, and detects SIP single-source flood attacks.

[0012] Abnormal traffic detection method based on data mining and machine learning: Use machine learning models to classify traffic features and detect abnormal attack traffic. For example, in Chinese patent CN110336830B, it is proposed to use SVM to detect DDoS attack traffic on SDN, and CN110149343B proposes to use clustering algorithms to detect abnormal communication behaviors in the intranet.

[0013] Although this type of method can effectively detect DoS attacks, it is difficult to meet the real-time detection requirements in model applications due to the slow training speed and low execution efficiency of machine learning models. At the same time, it is difficult to dynamically maintain the balance between missed detection of unknown attacks and false detection of normal traffic according to changes in traffic characteristics. This makes it difficult for the algorithm to achieve a perfect balance between detection accuracy, unknown attack discovery rate and detection efficiency in practical applications.

[0014] In order to meet the timeliness and accuracy of the abnormal traffic detection model in the communication network in the VoIP system, further improve the security of the VoIP system, and protect user privacy and key enterprise information, it is necessary to invent a SIP-based DoS attack abnormal traffic real-time detection model for deployment in the soft switch network, which can capture, count, detect and alarm the SIP-based invitation flooding DoS attack abnormal traffic in the soft switch network in real time. Summary of the invention

[0015] The present invention aims to provide a SIP-DoS attack detection method, system, device and storage medium based on traffic statistical characteristics, so as to realize abnormal traffic detection and alarm of SIP-based signaling flooding DoS attack in network traffic. The specific technical scheme is as follows:

[0016] In a first aspect, a SIP-DoS attack detection method based on traffic statistical characteristics includes the following process:

[0017] S100: Capturing VoIP call traffic; specifically, importing a data set encapsulated in the form of a cap locally, and releasing the encapsulated data to the SIP network in sequence according to the timestamp of the initial capture through a deserialization process during the import process;

[0018] S200: Parse the content, request attributes, and IP and port number information of the SIP message;

[0019] S300: Determine the theoretical SIP network maximum packet rate initialization value v rate_max ; The specific calculation formula is as follows:

[0020]

[0021] Where K is a constant, representing the theoretical upper limit of the SIP call traffic that the SIP system deploying this algorithm can handle within the sampling period, in bits; S is the sampling period, in seconds;

[0022] S400: Calculate each key threshold in each sampling period, including the current threshold, normal threshold, threat threshold, and attack threshold. The specific calculation process is as follows:

[0023] Get the amount of data per unit time k within the sampling period current , the calculation formula is as follows:

[0024]

[0025] Where, B represents the total byte length of SIP packets captured within the statistical time up to the sampling period, that is, the cumulative sum of the byte lengths of SIP packets since the system started detecting; b represents the total byte length of SIP packets up to the previous sampling time, and t represents the length of the sampling period;

[0026] The amount of data per unit time within the statistical time period is calculated using the following formula:

[0027] total_sum=∑k current ;

[0028] The SIP data packets are counted within the statistical time. The formula is as follows:

[0029] sip_count=sip_count+1;

[0030] Compare the maximum packet rate recorded during the statistical time and the bandwidth of the current sampling period. The formula is as follows:

[0031] period_max=max(period_max',k current ,v rate_max ×0.9);

[0032] Correspondingly, the key threshold calculation formula is as follows:

[0033] Current threshold Bound current , the calculation formula is as follows:

[0034] Bound current =k current ;

[0035] Normal threshold Bound normal , the calculation formula is as follows:

[0036] Bound normal =total_sum / sip_count;

[0037] Attack threshold Bound attact , the calculation formula is as follows:

[0038] Bound attact =period_max;

[0039] Threat Threshold Bound suspect , the calculation formula is as follows:

[0040] Bound suspect =(Bound normal +Bound attact ) / 2;

[0041] S500: Based on the comparison between the current traffic key parameters and four thresholds and two ratios, when the data flow rate related to a certain IP address in the network is greater than the Bound suspect , an attack alert with a weight of a for the IP is generated as the preliminary detection result; when the data flow rate related to a certain IP address in the network is greater than Bound attact , an attack alarm with a weight of b for the IP is generated as a preliminary detection result; when the data flow rate related to a certain IP address in the network is greater than 95% of period_max, an attack alarm with a weight of c for the IP is generated as a preliminary detection result;

[0042] S600: Calculate the data packet throughput ratio corresponding to each subnet IP, the formula is as follows:

[0043] pkt_now[ip]=in_pkt current [ip] / out_pkt current [ip];

[0044] Among them, ip is each IP address in the subnet, in_pkt current out_pkt is the data packet counter flowing into each IP address in this cycle. current It is the data packet counter of each IP address flowing out during this period;

[0045] Calculate the traffic throughput ratio corresponding to each subnet IP, the formula is as follows:

[0046] flow_now[ip]=in_flow current [ip] / out_flow current [ip];

[0047] Among them, ip is each IP address in the subnet, in_flow current and out_flow current Respectively represent the inbound and outbound traffic of the IP in this statistical period.

[0048] Calculate the packet throughput ratio of each subnet using the following formula:

[0049]

[0050] Among them, pkt_avg' is the original value of the corresponding IP subnet data packet throughput rate, which is initially set to 1. α is the adaptation rate, which can be a floating point value between (0, 2). The smaller the value, the more historical values ​​are used to calculate the average value, making it more stable. The larger the value, the less sensitive the average value is to traffic fluctuations.

[0051] Calculate the traffic throughput ratio of each subnet using the following formula:

[0052]

[0053] S700: When the error between the data throughput rate ratio and the data packet number ratio related to a certain IP address in the network and the corresponding historical average value Δ f [ip] and Δ p [ip] is greater than or equal to 0.3, an attack alert with a weight of d is generated for the IP as the preliminary detection result; when the error between the throughput data flow rate ratio and the number of packets related to a certain IP address in the network and the corresponding historical average value is Δ f [ip] and Δ p [ip] is greater than or equal to 0.5, an attack alert with a weight of e for the IP is generated as the preliminary detection result; the error rate calculation method is shown in the formula:

[0054]

[0055] S800: Determine whether the corresponding SIP message flow meets the alarm output condition according to the weighted voting method for each IP address. The calculation formula is as follows:

[0056] threat_lvl[ip]=∑w alert [ip],

[0057] where ∑w alert [ip] is the sum of the alarm weights a, b, c, d, and e for this IP;

[0058] S900: When the total voting weight exceeds the preset alarm threshold f, turn to S1000, otherwise return to S100;

[0059] S1000: The output module in the alarm information generation module outputs alarm information including relevant attack source information to the terminal, thereby completing the real-time detection of SIP-DoS attack traffic.

[0060] In a second aspect, a SIP-DoS attack detection system based on traffic statistics characteristics that implements the above attack detection method includes:

[0061] The data acquisition module is used to capture the messages in the SIP soft switch network through the mirror port and parse the messages into a serialized format for use in subsequent processes;

[0062] The DoS attack detection module is used to receive the parsed serialized messages from the data collection module, count the inflow and outflow traffic and the number of inflow and outflow packets of different IP addresses according to the message IP addresses, update the self-learning traffic threshold and compare it with the detection threshold to generate preliminary detection results;

[0063] The alarm information generation module is used to receive the detection results from the DoS attack detection module, use weighted voting to determine whether the system is attacked according to user-defined rules, and output the final alarm information to the terminal.

[0064] In a third aspect, a SIP-DoS attack detection device based on traffic statistical features includes: a memory, a processor and a transceiver that are communicatively connected in sequence, wherein the memory is used to store a computer program, the transceiver is used to send and receive messages, and the processor is used to read the computer program and execute the above-mentioned SIP-DoS attack detection method based on traffic statistical features.

[0065] In a fourth aspect, a computer-readable storage medium stores instructions, and when the instructions are executed on a computer, the above-mentioned SIP-DoS attack detection method based on traffic statistical characteristics is executed.

[0066] The present invention has the following advantages:

[0067] The present invention establishes a SIP-DoS attack traffic real-time detection model for discovering and defending against signaling flooding SIP-DoS attacks, so that the detection terminal equipment applying the model has better real-time abnormal traffic detection capability and detection accuracy.

[0068] The present invention establishes a real-time detection model for SIP-DoS attack traffic based on the statistical characteristics of associated IP inflow and outflow traffic, so that the attack detection system using the method has a better detection effect on attack strategies such as signaling flooding and forged source IP addresses.

[0069] The present invention combines a SIP-DoS attack traffic real-time detection model based on a self-learning traffic threshold with a SIP-DoS attack traffic real-time detection model based on statistical characteristics of associated IP inflow and outflow traffic, and the combined model has better detection efficiency.

[0070] The present invention establishes an alarm information generation method based on a weighted voting algorithm, which effectively integrates the threat discrimination information given by different attack detection methods, so that the model has a higher attack detection rate and a lower false alarm rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 The present invention is a schematic diagram of the composition of a SIP-DoS attack detection system based on traffic statistical characteristics. DETAILED DESCRIPTION

[0072] A SIP-DoS attack detection method based on traffic statistical characteristics includes the following steps:

[0073] S100: Capturing VoIP call traffic; specifically, importing a data set encapsulated in the form of a cap locally, and releasing the encapsulated data to the SIP network in sequence according to the timestamp of the initial capture through a deserialization process during the import process;

[0074] S200: Parse the content, request attributes, and address information such as IP and port number of the SIP message;

[0075] S300: Determine the theoretical SIP network maximum packet rate initialization value v rate_max ; The specific calculation formula is as follows:

[0076]

[0077] Where K is a constant, representing the theoretical upper limit of the SIP call traffic that the SIP system deploying this algorithm can handle within the sampling period, in bits; S is the sampling period, in seconds;

[0078] S400: Calculate each key threshold in each sampling period, including the current threshold, normal threshold, threat threshold, and attack threshold. The specific calculation process is as follows:

[0079] Get the amount of data per unit time k within the sampling period current , the calculation formula is as follows:

[0080]

[0081] Where, B represents the total byte length of SIP packets captured within the statistical time up to the sampling period, that is, the cumulative sum of the byte lengths of SIP packets since the system started detecting; b represents the total byte length of SIP packets up to the previous sampling time, and t represents the length of the sampling period;

[0082] The amount of data per unit time within the statistical time period is calculated using the following formula:

[0083] total_sum=∑kcurrent ;

[0084] The SIP data packets are counted within the statistical time. The formula is as follows:

[0085] sip_count=sip_count+1;

[0086] Compare the maximum packet rate recorded during the statistical time and the bandwidth of the current sampling period. The formula is as follows:

[0087] period_max=max(period_max',k current ,v rate_max ×0.9);

[0088] Correspondingly, the key threshold calculation formula is as follows:

[0089] Current threshold Bound current , the calculation formula is as follows:

[0090] Bound current =k current ;

[0091] Normal threshold Bound normal , the calculation formula is as follows:

[0092] Bound normal =total_sum / sip_count;

[0093] Attack threshold Bound attact , the calculation formula is as follows:

[0094] Bound attact =period_max;

[0095] Threat Threshold Bound suspect , the calculation formula is as follows:

[0096] Bound suspect =(Bound normal +Bound attact ) / 2;

[0097] S500: Based on the comparison between the current traffic key parameters and four thresholds and two ratios, when the data flow rate related to a certain IP address in the network is greater than the Bound suspect , an attack alert with a weight of 0.5 is generated for the IP as the preliminary detection result; when the data flow rate related to a certain IP address in the network is greater than the Bound attact, an attack alarm with a weight of 0.8 is generated for the IP as the preliminary detection result; when the data flow rate related to a certain IP address in the network is greater than 95% of period_max, an attack alarm with a weight of 1.0 is generated for the IP as the preliminary detection result;

[0098] S600: Calculate the data packet throughput ratio corresponding to each subnet IP, the formula is as follows:

[0099] pkt_now[ip]=in_pkt current [ip] / out_pkt current [ip];

[0100] Among them, ip is each IP address in the subnet, in_pkt current out_pkt is the data packet counter flowing into each IP address in this cycle. current It is the data packet counter of each IP address flowing out during this period;

[0101] Calculate the traffic throughput ratio corresponding to each subnet IP, the formula is as follows:

[0102] flow_now[ip]=in_flow current [ip] / out_flow current [ip];

[0103] Among them, ip is each IP address in the subnet, in_flow current and out_flow current Respectively represent the inbound and outbound traffic of the IP in this statistical period.

[0104] Calculate the packet throughput ratio of each subnet using the following formula:

[0105]

[0106] Among them, pkt_avg' is the original value of the corresponding IP subnet data packet throughput rate, which is initially set to 1. α is the adaptation rate, which can be a floating point value between (0, 2). The smaller the value, the more historical values ​​are used to calculate the average value, making it more stable. The larger the value, the less sensitive the average value is to traffic fluctuations.

[0107] Calculate the traffic throughput ratio of each subnet using the following formula:

[0108]

[0109] S700: When the error between the data throughput rate ratio and the data packet number ratio related to a certain IP address in the network and the corresponding historical average value Δ f [ip] and Δ p[ip] is greater than or equal to 0.3, an attack alert with a weight of 0.5 is generated for the IP as the preliminary detection result; when the error between the throughput data flow rate ratio and the number of packets related to a certain IP address in the network and the corresponding historical average value is Δ f [ip] and Δ p [ip] is greater than or equal to 0.5, an attack alert with a weight of 1.0 is generated for the IP as the preliminary detection result; the error rate calculation method is shown in the formula:

[0110]

[0111] S800: Determine whether the corresponding SIP message flow meets the alarm output condition according to the weighted voting method for each IP address. The calculation formula is as follows:

[0112] threat_lvl[ip]=∑w alert [ip],

[0113] where ∑w alert [ip] is the sum of the alarm weights for this IP;

[0114] S900: When the total voting weight exceeds the preset alarm threshold 1.3, go to S1000, otherwise return to S100;

[0115] S1000: The output module in the alarm information generation module outputs alarm information including relevant attack source information to the terminal, thereby completing the real-time detection of SIP-DoS attack traffic.

Claims

1. A SIP-DoS attack detection method based on traffic statistics, characterized in that: The process includes the following: S100: Capturing VoIP call traffic; specifically, importing a data set encapsulated in the form of a cap locally, and releasing the encapsulated data to the SIP network in sequence according to the timestamp of the initial capture through a deserialization process during the import process; S200: Parse the content, request attributes, and IP and port number information of the SIP message; S300: Determine the theoretical SIP network maximum packet rate initialization value v rate_max ; The specific calculation formula is as follows: Where K is a constant, representing the theoretical upper limit of the SIP call traffic that the SIP system deploying this algorithm can handle within the sampling period, and the unit is bit; S is the sampling period in seconds; S400: Calculate each key threshold in each sampling period, including the current threshold, normal threshold, threat threshold, and attack threshold. The specific calculation process is as follows: Get the amount of data per unit time k within the sampling period current , the calculation formula is as follows: Where, B represents the total byte length of SIP packets captured within the statistical time up to the sampling period, that is, the cumulative sum of the byte lengths of SIP packets since the system started detecting; b represents the total byte length of SIP packets up to the previous sampling time, and t represents the length of the sampling period; The amount of data per unit time within the statistical time period is calculated using the following formula: total_sum=∑k current ; The SIP data packets are counted within the statistical time. The formula is as follows: sip_count=sip_count+1; Compare the maximum packet rate recorded during the statistical time and the bandwidth of the current sampling period. The formula is as follows: period_max=max(period_max',k current ,v rate_max ×0.9); Correspondingly, the key threshold calculation formula is as follows: Current threshold Bound current , the calculation formula is as follows: Bound current =k current ; Normal threshold Bound normal , the calculation formula is as follows: Bound normal =total_sum / sip_count; Attack threshold Bound attact , the calculation formula is as follows: Bound attact =period_max; Threat Threshold Bound suspect , the calculation formula is as follows: Bound suspect =(Bound normal +Bound attact ) / 2; S500: Based on the comparison between the current traffic key parameters and four thresholds and two ratios, when the data flow rate related to a certain IP address in the network is greater than the Bound suspect , an attack alert with a weight of a for the IP is generated as the preliminary detection result; when the data flow rate related to a certain IP address in the network is greater than Bound attact , an attack alarm with a weight of b for the IP is generated as a preliminary detection result; when the data flow rate related to a certain IP address in the network is greater than 95% of period_max, an attack alarm with a weight of c for the IP is generated as a preliminary detection result; S600: Calculate the data packet throughput ratio corresponding to each subnet IP, the formula is as follows: pkt_now[ip]=in_pkt current [ip] / out_pkt current [ip]; Among them, ip is each IP address in the subnet, in_pkt current out_pkt is the data packet counter flowing into each IP address in this cycle. current It is the data packet counter of each IP address flowing out during this period; Calculate the traffic throughput ratio corresponding to each subnet IP, the formula is as follows: flow_now[ip]=in_flow current [ip] / out_flow current [ip]; Among them, ip is each IP address in the subnet, in_flow current and out_flow current Respectively represent the inbound and outbound traffic of the IP in this statistical period. Calculate the packet throughput ratio of each subnet. The formula is as follows: Among them, pkt_avg' is the original value of the corresponding IP subnet data packet throughput rate, which is initially set to 1. α is the adaptation rate, which can be a floating point value between (0, 2). The smaller the value, the more historical values ​​are used to calculate the average value, making it more stable. The larger the value, the less sensitive the average value is to traffic fluctuations. Calculate the traffic throughput ratio of each subnet using the following formula: S700: When the error between the data throughput rate ratio and the data packet number ratio related to a certain IP address in the network and the corresponding historical average value Δ f [ip] and Δ p [ip] is greater than or equal to 0.3, an attack alert with a weight of d is generated for the IP as the preliminary detection result; when the error between the throughput data flow rate ratio and the number of packets related to a certain IP address in the network and the corresponding historical average value is Δ f [ip] and Δ p [ip] is greater than or equal to 0.5, an attack alert with a weight of e for the IP is generated as the preliminary detection result; the error rate calculation method is shown in the formula: S800: Determine whether the corresponding SIP message flow meets the alarm output condition according to the weighted voting method for each IP address. The calculation formula is as follows: threat_lvl[ip]=∑w alert [ip], where ∑w alert [ip] is the sum of the alarm weights a, b, c, d, and e for this IP; S900: When the total voting weight exceeds the preset alarm threshold f, go to S1000, otherwise return to S100; S1000: The output module in the alarm information generation module outputs alarm information including relevant attack source information to the terminal, thereby completing the real-time detection of SIP-DoS attack traffic.

2. According to claim 1, a SIP-DoS attack detection method based on traffic statistical characteristics is characterized in that: In the S500, a=0.5, b=0.8, c=1; in the S700, d=0.5, e=1.

0.

3. According to claim 2, a SIP-DoS attack detection method based on traffic statistical characteristics is characterized in that: In the S900, f=1.

3.

4. A SIP-DoS attack detection system based on traffic statistics, characterized in that: include: The data acquisition module is used to capture the messages in the SIP soft switch network through the mirror port and parse the messages into a serialized format for use in subsequent processes; The DoS attack detection module is used to receive the parsed serialized messages from the data collection module, count the inflow and outflow traffic and the number of inflow and outflow packets of different IP addresses according to the message IP addresses, update the self-learning traffic threshold and compare it with the detection threshold to generate preliminary detection results; The alarm information generation module is used to receive the detection results from the DoS attack detection module, use weighted voting to determine whether the system is attacked according to user-defined rules, and output the final alarm information to the terminal.

5. A SIP-DoS attack detection device based on traffic statistics characteristics, characterized in that: include: A memory, a processor and a transceiver that are sequentially communicatively connected, wherein the memory is used to store a computer program, the transceiver is used to send and receive messages, and the processor is used to read the computer program to execute the SIP-DoS attack detection method based on traffic statistical features as described in any one of claims 1 to 3.

6. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on the computer, the SIP-DoS attack detection method based on traffic statistical characteristics as described in any one of claims 1 to 3 is executed.

Images