SIP (Session Initiation Protocol)-based network attack multi-stage detection and tracing method, system, equipment and medium
By deploying servers to collect and filter traffic in VoIP networks, using Redis database for data association and cache, combined with rule-based detection rules, multi-level detection of SIP network attacks is achieved, and detection accuracy and response in the prior art are solved The problem of insufficient speed improves the security of VoIP network.
Patent Information
- Application Number
- CN202411597937.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-11
- Publication Date
- 2025-02-14
AI Technical Summary
In the prior art, when detecting SIP network attacks in VoIP networks, especially DoS attacks, there are shortcomings in detection accuracy, real-timeness, degree of automation and practical application.
Design a multi-level detection and traceability method for network attacks based on SIP. By deploying servers near voice network switches, collecting and filtering the mirror traffic of voice network switches, using Redis database to save and associate traffic characteristic data, and combining rules-based Detection and filtering rules to realize multi-level detection of signaling link attacks, malformed message attacks and DoS attacks.
Improve the detection accuracy and response speed of DoS attacks, realize end-to-end traceability of attack sessions, meet the timeliness and accuracy of abnormal traffic detection and traceability in VoIP communication networks, and provide network operators and security experts with An effective tool that improves the security of VoIP networks.
Smart Images
Figure CN119449431A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of digital information transmission, and in particular to a SIP-based network attack multi-level detection and tracing method, system, equipment and medium. Technical Background
[0002] In the current network environment, SIP-based VoIP applications are becoming more and more popular. Their low cost and rich functions bring convenience to communication users. However, as the business of VoIP network expands, it also faces increasingly severe security challenges, especially DoS (Denial of Service) attacks. DoS attacks exhaust network resources, making it impossible for legitimate users to use services, posing a serious threat to the stability and reliability of VoIP networks.
[0003] SIP (Session Initiation Protocol) is a text-based protocol that focuses on ease of use and flexibility, but its security has not been fully considered. This makes the SIP network vulnerable to a variety of attacks, including signaling link attacks, malformed message attacks, DoS attacks and other common network attacks.
[0004] When VoIP faces various attacks, it is also very important to trace the attack calls sent by the attackers so that corresponding protection measures can be taken and defense rules can be established. By analyzing and identifying the characteristics and patterns in the communication traffic, correlating the related communication sessions, and providing comprehensive tracing capabilities for attack calls, a more efficient solution will be provided for the security protection of VoIP.
[0005] To address these challenges, existing security mechanisms mainly rely on authentication and encryption technologies. Authentication technologies such as HTTP digest authentication are mainly used to verify the legitimacy and validity of SIP network nodes, while encryption technologies such as IPSec, TLS, and S / MIME are dedicated to ensuring the secure transmission of SIP messages on the network. Although these mechanisms have played a role in defending against network tampering and registration hijacking, they are not able to defend against DoS attacks. Therefore, it is necessary to conduct in-depth research on SIP security mechanisms, especially DoS attack detection.
[0006] In the research field of SIP DoS attack detection, many methods have been proposed. For example, the detection algorithm based on information entropy detects anomalies by analyzing the distribution changes of variables such as IP, port, and number of messages in the traffic, while the detection algorithm based on relative entropy detects DoS attacks by measuring the similarity between two random sequences. In addition, researchers have proposed detection algorithms based on group message balance and defense methods based on queuing theory, as well as hierarchical network attack identification and unknown attack detection methods using deep learning.
[0007] Traditional attack tracing methods usually rely on logging, packet marking technology, and active perception data. The logging-based tracing method tracks the source of the attack by analyzing network devices such as routers and firewalls, but the storage overhead is large, and in high-speed networks, information may be lost due to log overwrite issues. At the same time, the analysis and processing of logs are also relatively complex and time-consuming. The tracing method based on packet marking technology tracks attacks by marking path information on data packets, but this information may be affected by attackers tampering with the marks, and in a massive network traffic environment, the marks may be overwritten. The tracing method based on active perception data collects abnormal behavior data in the mobile phone network through actively deployed sensors and honeypots.
[0008] However, although some progress has been made in existing research, the existing technology still needs to be improved in terms of detection accuracy, real-time performance, degree of automation and practical applicability. Summary of the invention
[0009] The present invention designs a multi-level detection and tracing method system, equipment and medium for network attacks based on SIP in a VoIP application environment. The specific technical solution is as follows:
[0010] In the first aspect, a multi-level detection and tracing method for network attacks based on SIP includes the following processes:
[0011] S100: Traffic collection and filtering; specifically including:
[0012] S110: deploy a server at a node near the voice network switch, collect the voice network switch mirror traffic by setting a capture interface, a mirror port, and network packet capture, and perform multi-scale traffic capture;
[0013] S120: by configuring the traffic capture filter, completing the preprocessing process of the captured traffic, and cleaning, converting and filtering the original call traffic data, so as to provide more accurate and efficient data for subsequent traffic analysis and processing;
[0014] S200: Use network traffic analysis tools to perform multi-dimensional wide-area analysis on captured traffic and extract key call features; filter and analyze call-related data by setting specific protocols; further calculate call quality indicators, and count call types and data transmission volume, providing a comprehensive framework for network traffic and call quality analysis;
[0015] S300: Establish a Redis database, use Redis to save and associate the feature data obtained in the previous step, and forward the traffic cache and analysis data of different dimensions to different stream structures of Redis for efficient caching;
[0016] S400: Session association and tracing: classify and sort the feature data in the Redis stream to form a flow information association table, which includes specific information related to the session initiation and intermediate process, such as user Call-ID, calling / called mobile phone number, session start / end time, etc.
[0017] S500: Detection of signaling link attacks and malformed message attacks; specifically includes:
[0018] Through a set of rule-based detection and filtering rules, abnormal SIP traffic is filtered and blocked for signaling link attacks and malformed messages, and some common network attacks based on text tampering are quickly identified and prevented;
[0019] S600: DoS attack detection for SIP; specifically comprising: constructing DoS attack fusion detection rules for SIP according to data of session feature fields such as region in the flow information association table in the SIP network.
[0020] In a second aspect, a SIP-based network attack multi-level detection and tracing system is provided, the system comprising:
[0021] Traffic collection and filtering module, used to capture multi-scale traffic and clean, convert and filter raw call traffic data;
[0022] The message processing and inspection module is used to analyze and extract features from the pre-processed traffic messages;
[0023] The Redis database module is used to store and associate feature data extracted from real-time traffic, and also serves as a dynamic buffer for real-time threat data to be persisted in the database.
[0024] The session association and tracing module is used to read traffic characteristics from the stream of the Redis database module, classify and organize the characteristic data, and form a traffic information association table;
[0025] Signaling link attack and malformed message attack detection module, used to filter and block abnormal SIP traffic for signaling link attack and malformed message attack, and quickly identify and prevent some common network attacks based on text tampering;
[0026] The SIP-oriented DoS attack detection module is used for SIP-oriented DoS attack detection.
[0027] According to a third aspect, an electronic device includes:
[0028] The memory is used to store computer program instructions; the processor is used to execute the computer program instructions to complete the above-mentioned SIP-based network attack multi-level detection and tracing method.
[0029] In a fourth aspect, a computer-readable storage medium is used to store computer-readable computer program instructions, wherein the computer program instructions are configured to execute the above-mentioned SIP-based network attack multi-level detection and tracing method when running.
[0030] The present invention has the following advantages:
[0031] The present invention provides a SIP-based network attack multi-level detection and tracing method. By deploying a comprehensive detection framework in a terminal soft switch voice network, the method can effectively perform field checks on signaling link attacks and malformed message attacks when receiving SIP traffic, and improve the detection accuracy and response speed of DoS attacks through a multi-level detection mechanism.
[0032] In addition, this method introduces a two-level hash-based session association technology to achieve end-to-end tracing of attack sessions.
[0033] In summary, the present invention can realize the identification, tracing and traffic alarm of abnormal traffic based on SIP network attacks in the terminal soft switch voice network, meet the timeliness and accuracy of abnormal traffic detection and tracing in the VoIP communication network, and provide an effective tool for network operators and security experts to improve the security of VoIP networks. BRIEF DESCRIPTION OF THE DRAWINGS
[0034] Figure 1 The present invention is a flow chart of a multi-level detection and tracing method of network attacks based on SIP.
[0035] Figure 2 It is a schematic diagram of the process of establishing and maintaining the session association table in S400 of the present invention. DETAILED DESCRIPTION
[0036] A multi-level detection and tracing method for network attacks based on SIP includes the following processes:
[0037] S100: Traffic collection and filtering; specifically including:
[0038] S110: deploy a server at a node near the voice network switch, collect the voice network switch mirror traffic by setting a capture interface, a mirror port, and network packet capture, and perform multi-scale traffic capture;
[0039] S120: by configuring the traffic capture filter, completing the preprocessing process of the captured traffic, and cleaning, converting and filtering the original call traffic data, so as to provide more accurate and efficient data for subsequent traffic analysis and processing;
[0040] S200: message processing and inspection; specifically including:
[0041] S210: Analyze and extract features of the pre-processed traffic packets, and conduct preliminary wide-area analysis of the data from the aspects of time dimension, call frequency, traffic inflow and outflow ratio, and overall traffic quantity;
[0042] S220: According to the protocol or data packet characteristics of the call platform, by setting a specific protocol to be analyzed in the traffic analysis method, filtering out the traffic data characteristic fields related to the call;
[0043] S230: Extracting the IP addresses of the caller and the called party, as well as the start time and end time of the call;
[0044] S240: Calculation is performed based on the traffic feature fields obtained by filtering, and key statistical features can also be obtained, such as calculating the duration of the call according to the extracted timestamp, calculating call quality-related features to analyze call quality indicators according to the signal quality, packet loss rate, and delay indicators in the captured traffic data, extracting the call type according to the protocol or data packet identifier in the traffic, and counting the size of the data packet transmitted in each call to calculate the amount of data transmitted during the call;
[0045] S300: Use Redis to cache traffic information; specifically, including:
[0046] S310: For high-throughput call traffic, Redis with high throughput, low latency and high-performance processing is used as an automatic cache medium to save and associate feature data extracted from real-time traffic, and also as a dynamic buffer between real-time threat data and persistent storage in the database;
[0047] S320: Establish a Redis database, and forward the traffic cache and analysis data of different dimensions to different stream structures of Redis for efficient caching;
[0048] S400: Session association and tracing; specifically including:
[0049] S410: Read traffic features from the Redis stream, classify and organize the feature data to form a traffic information association table; the traffic information association table includes the user Call-ID, calling / called mobile phone number, session start / end time, session sequence number CSeq, session content length, session geographic information, and specific information related to session initiation and intermediate processes. This information is recorded in Redis and used to associate and analyze various session data;
[0050] S420: By constructing a two-level hash-based session association algorithm, high efficiency and accuracy are maintained when processing a large number of SIP messages. Each SIP message of a call is mapped to a unique session ID, and the session ID and other call-related information are stored in the session association table; such as source IP address, destination IP address, timestamp, etc.). Therefore, each SIP session can be uniquely identified, and all information related to it can be quickly retrieved; the process of establishing and maintaining the session association table is as follows: Figure 2 ; Through a two-level hash function, the Call-ID in the SIP message and the identification number in the From header are mapped to two different hash bucket indexes. The two indexes are combined to form a unique session ID that is used to identify a specific SIP session;
[0051] S430: When a new SIP message arrives, the system matches it with the stored information according to the session ID; if a matching session is found, the relevant information is updated; if no matching session is found, a new session entry is created;
[0052] S500: Detection of signaling link attacks and malformed message attacks; specifically includes:
[0053] Through a set of rule-based detection and filtering rules, abnormal SIP traffic is filtered and blocked for signaling link attacks and malformed messages, and some common network attacks based on text tampering are quickly identified and prevented;
[0054] S600: DoS attack detection for SIP; specifically including: according to the data of session characteristic fields such as region in the flow information association table in the SIP network, a method is used to construct DoS attack fusion detection rules for SIP; specifically including:
[0055] S610: Based on feature analysis, the method performs statistical analysis on relevant traffic based on source / destination IP addresses, and uses a Z-score method to identify abnormal SIP traffic; the method sets alarm rules and thresholds, and determines whether to generate an alarm based on preliminary detection results;
[0056] S620: The comprehensive threat weight of each IP address is then calculated to evaluate whether the alarm threshold is reached, and the alarm information is propagated to the detection device terminal for evaluation by the platform security administrator.
[0057] In terms of real-time attack detection, the method was able to respond within 10 seconds after the attack started in the test data. In two sets of verification experiments involving 28 attacks, the average response time was 5.62 seconds and the longest response time was only 9.77 seconds, indicating that the method has strong real-time detection capabilities and performs well under different conditions and attack intensities. In terms of attack detection accuracy and false alarm rate, the method generated 32 alarm messages for 28 attacks, of which 4 were false alarms. Of the remaining 28 valid alarms, 26 correctly identified the test attack IP address, indicating that the method has good alarm accuracy and can effectively trace attack traffic.
[0058] Based on flow rate statistics, the method saves each flow feature threshold to the configuration file through pre-training, and adds alarm generation rules to the configuration file. During the detection process, the method captures the incoming network traffic in real time, traverses each subnet IP address regularly (such as every 30 seconds), counts the corresponding inflow and outflow traffic, the number and proportion of data packets, compares the traffic average and fluctuation range in the training data, and calls the preset K-nearest neighbor outlier detection algorithm in the threat judgment link according to the method configuration information to determine the probability of abnormality in each subnet IP traffic in the current period, and generates threat information with different weights according to the degree of data abnormality. The method will determine whether the threat information on each IP in the SIP network reaches the alarm threshold and identify potential attack behaviors in the network. If the alarm threshold is reached, the alarm information of the corresponding IP address will be output to the detection device terminal for the platform security administrator to judge and use.
[0059] Table 1 Experimental results of SIP DoS detection method
[0060] Detection method based on flow velocity statistics Detection method based on feature analysis Response time 5.62s 6.8s Alarm accuracy 81.3％ 72.4％
[0061] Based on the experimental data, the detection method based on flow rate statistics has certain advantages in response time and attack alarm accuracy compared with the detection method based on feature analysis. The attack detection method based on feature analysis can effectively perceive low-intensity SIP DoS attacks and generate corresponding alarm information before the attack affects the actual business; the attack detection method based on flow rate statistics is more sensitive to system abnormalities and has a better detection effect on some special low-speed DoS attacks, such as continuous channel occupation and low-speed BYE Flood.
[0062] Based on the above experimental analysis results, this method combines the attack detection method based on flow rate statistics and feature analysis to take into account the sensitivity and timeliness of DoS attack detection, and realizes the effective detection of SIP DoS attacks with various different characteristics.
Claims
1. A multi-level detection and tracing method for network attacks based on SIP, characterized in that: The process includes the following: S100: Traffic collection and filtering; specifically including: S110: deploy a server at a node near the voice network switch, collect the voice network switch mirror traffic by setting a capture interface, a mirror port, and network packet capture, and perform multi-scale traffic capture; S120: by configuring the traffic capture filter, completing the preprocessing process of the captured traffic, and cleaning, converting and filtering the original call traffic data, so as to provide more accurate and efficient data for subsequent traffic analysis and processing; S200: Use network traffic analysis tools to perform multi-dimensional wide-area analysis on captured traffic and extract key call features; filter and analyze call-related data by setting specific protocols; further calculate call quality indicators, and count call types and data transmission volume, providing a comprehensive framework for network traffic and call quality analysis; S300: Establish a Redis database, use Redis to save and associate the feature data obtained in the previous step, and forward the traffic cache and analysis data of different dimensions to different stream structures of Redis for efficient caching; S400: Session association and tracing: classify and sort the feature data in the Redis stream to form a flow information association table, which includes specific information such as user Call-ID, calling / called mobile phone number, session start / end time, and session initiation and intermediate process; S500: Detection of signaling link attacks and malformed message attacks; specifically includes: Through a set of rule-based detection and filtering rules, abnormal SIP traffic is filtered and blocked for signaling link attacks and malformed messages, and some common network attacks based on text tampering are quickly identified and prevented; S600: DoS attack detection for SIP; specifically including: based on the data of the regional session feature field in the flow information association table in the SIP network, the model constructs DoS attack fusion detection rules for SIP.
2. A multi-level detection and tracing method for network attacks based on SIP, characterized in that: The S200 specifically includes the following process: S210: Analyze and extract features of the pre-processed traffic packets, and conduct preliminary wide-area analysis of the data from the aspects of time dimension, call frequency, traffic inflow and outflow ratio, and overall traffic quantity; S220: According to the protocol or data packet characteristics of the call platform, by setting a specific protocol to be analyzed in the traffic analysis model, filtering out the traffic data characteristic fields related to the call; S230: Extracting the IP addresses of the caller and the called party, as well as the start time and end time of the call; S240: Calculations are performed based on the traffic feature fields obtained through filtering, and key statistical features can also be obtained, such as calculating the duration of a call based on the extracted timestamp, calculating call quality-related features to analyze call quality indicators based on the signal quality, packet loss rate, and delay indicators in the captured traffic data, extracting the call type based on the protocol or data packet identifier in the traffic, and counting the size of the data packet transmitted in each call to calculate the amount of data transmitted during the call.
3. A multi-level detection and tracing method for network attacks based on SIP, characterized in that: The S300 specifically includes the following process: S310: For high-throughput call traffic, Redis with high throughput, low latency and high-performance processing is used as an automatic cache medium to save and associate feature data extracted from real-time traffic, and also as a dynamic buffer between real-time threat data and persistent storage in the database; S320: Establish a Redis database, and forward the traffic cache and analysis data of different dimensions to different stream structures of Redis for efficient caching.
4. A multi-level detection and tracing method for network attacks based on SIP, characterized in that: The S400 specifically includes the following process: S410: Read traffic features from the Redis stream, classify and organize the feature data to form a traffic information association table; the traffic information association table includes the user Call-ID, calling / called mobile phone number, session start / end time, session sequence number CSeq, session content length, session geographic information, and specific information related to session initiation and intermediate processes. This information is recorded in Redis and used to associate and analyze various session data; S420: by constructing a two-level hash-based session association algorithm, maintaining high efficiency and accuracy when processing a large number of SIP messages, mapping each SIP message of a call to a unique session ID, and storing the session ID and other information related to the call in a session association table; Through a two-level hash function, the Call-ID in the SIP message and the identification number in the From header are mapped to two different hash bucket indexes. The two indexes are combined to form a unique session ID that is used to identify a specific SIP session; S430: When a new SIP message arrives, the system matches it with the stored information based on the session ID; if a matching session is found, the relevant information is updated; If no matching session is found, a new session entry is created.
5. According to the SIP-based network attack multi-level detection and tracing method of claim 1, S600 specifically comprises: S610: Based on feature analysis, the model performs statistical analysis on relevant traffic based on source / destination IP addresses and uses the Z-score method to identify abnormal SIP traffic; The model sets alert rules and thresholds, and determines whether to generate an alert based on the initial detection results; S620: The comprehensive threat weight of each IP address is then calculated to evaluate whether the alarm threshold is reached, and the alarm information is propagated to the detection device terminal for evaluation by the platform security administrator.
6. A SIP-based network attack multi-level detection and tracing system that implements the network attack multi-level detection and tracing method of claim 1, characterized in that: The system comprises: Traffic collection and filtering module, used to capture multi-scale traffic and clean, convert and filter the original call traffic data; The message processing and inspection module is used to analyze and extract features from the pre-processed traffic messages; The Redis database module is used to store and associate feature data extracted from real-time traffic, and also serves as a dynamic buffer for real-time threat data to be persisted in the database. The session association and tracing module is used to read traffic characteristics from the stream of the Redis database module, classify and organize the characteristic data, and form a traffic information association table; Signaling link attack and malformed message attack detection module, used to filter and block abnormal SIP traffic for signaling link attack and malformed message attack, and quickly identify and prevent some common network attacks based on text tampering; The SIP-oriented DoS attack detection module is used for SIP-oriented DoS attack detection.
7. An electronic device, characterized in that: include: a memory for storing computer program instructions; A processor is used to execute the computer program instructions to complete the SIP-based network attack multi-level detection and tracing method as described in any one of claims 1-5.
8. A computer-readable storage medium for storing computer program instructions readable by a computer, characterized in that: The computer program instructions are configured to execute, when running, a SIP-based network attack multi-stage detection and tracing method as described in any one of claims 1 to 5.