SIP-based communication dispatching management system and method

Abstract

The application relates to the technical field of communication security, in particular to a SIP communication dispatching management system and method; the method comprises the following steps: acquiring historical SIP signaling messages and analyzing header fields, extracting the access frequency, registration request intensity and signaling state code distribution characteristics of each source address to form a time sequence characteristic sequence; behavior stability characteristics are extracted and mapped into multi-dimensional characteristic space discrete data points; a spatial clustering algorithm is used for clustering analysis, normal service clusters are extracted, and a two-level interception threshold is generated; current signaling messages are collected to calculate weighted characteristic space distances, dangerous levels are distinguished, bypass mirror forwarding and signaling blocking are performed on high-risk source addresses; mirror message protocols are analyzed and cross-source address correlation analysis is performed to identify attack types and cooperative attack relationships, and alarm results are fed back to update the normal service cluster boundary. The technical scheme of the application realizes accurate grading detection and closed-loop dynamic protection of SIP signaling abnormal behaviors.

Description

Technical Field

[0001] This application relates to the field of communication security technology, specifically to a SIP-based communication scheduling management system and method. Background Technology

[0002] As the core signaling control protocol of command and dispatch communication systems, the SIP protocol undertakes critical communication control functions such as terminal registration and authentication, call establishment management, and session state maintenance. Command and dispatch communication systems have stringent requirements for the real-time performance and security of signaling transmission; any security threat at the signaling layer can directly affect the continuity and reliability of command and dispatch services. With the continuous expansion of the scale of command and dispatch communication network access, attack methods targeting the SIP signaling layer are constantly evolving, making the technical challenges to signaling security increasingly prominent.

[0003] Existing SIP signaling security detection technologies typically extract behavioral features by aggregating signaling activity from source addresses within a preset statistical time window. This compresses all signaling activity over a period into a single static statistic, which is then used as the basis for anomaly detection. However, in actual command and dispatch communication scenarios, a type of covert signaling anomaly exists: its aggregated feature value across the entire statistical time window does not differ significantly from that of normal service source addresses, but it exhibits a drastic temporal fluctuation pattern that is drastically different from that of normal source addresses between different sub-time periods within the time window—that is, the attacking signaling exhibits abnormal behavioral instability between sub-time periods, while the overall aggregated value is deliberately controlled within a normal range. Existing technologies, by aggregating signaling activity within a time window into a single static feature value, cannot retain the behavioral evolution and fluctuation information between sub-time periods. This makes it impossible to effectively identify such covert attacks with normal aggregated statistics but abnormal temporal fluctuation patterns, creating a detection blind spot in the signaling security protection system and seriously threatening the secure operation of command and dispatch communication systems.

[0004] In view of this, this application proposes a SIP-based scheduling management system and method. Summary of the Invention

[0005] To achieve the above objectives, this application provides a SIP-based scheduling management system and method, the specific technical solution of which is as follows:

[0006] Firstly, this application provides a SIP-based scheduling and management method, including:

[0007] Obtain historical SIP signaling messages, parse the message header fields, extract the source address access frequency, registration request density and signaling status code distribution characteristics of each source address, and form a time-series feature sequence of each source address.

[0008] The time-series feature sequences of each source address are normalized, and the statistical fluctuation of the observation values ​​of each dimension of the time-series feature sequence is extracted as the behavioral stability feature. The normalized aggregated feature and the normalized behavioral stability feature are combined and mapped to discrete data points in a multi-dimensional feature space.

[0009] A density-based spatial clustering algorithm is used to perform cluster analysis on discrete data points, extract normal business clusters, calculate the weights of each dimension, and generate a two-level interception threshold by combining boundary features.

[0010] Collect current SIP signaling packets, statistically analyze the timing characteristics of the current source address and calculate the weighted feature spatial distance, distinguish medium-risk and high-risk anomaly levels based on the degree of distance deviation, and perform parallel bypass mirror forwarding and signaling blocking list distribution for high-risk anomaly source addresses;

[0011] In the isolated sandbox, the mirrored packets are parsed according to the protocol. By combining cross-source address association analysis, the attack types and collaborative attack relationships are identified, structured security alert events are generated and pushed, and the alert results are fed back to update the boundaries of normal business clusters.

[0012] Preferably, the step of obtaining historical SIP signaling messages and parsing the message header fields includes: configuring a port mirroring interface on the signaling transmission link of the command and dispatch core switching equipment to mirror and copy the SIP signaling messages to the signaling acquisition server;

[0013] The signaling acquisition server performs deduplication filtering based on the sequence number and acknowledgment number fields in the transport layer protocol header, timestamps the reception time of each message using a synchronized standard clock source, and segments and archives the messages according to a preset time window.

[0014] The preset time window is evenly divided into several consecutive sub-time segments that are connected end to end and do not overlap. The source address information is obtained by parsing the From field of the SIP protocol header of each message, and the request method type information is obtained by parsing the CSeq field. After grouping by source address, various features are statistically analyzed in each sub-time segment.

[0015] Preferably, the normalization process for the temporal feature sequence of each source address includes: for two types of scalar features, namely source address access frequency and registration request density, statistically analyzing the numerical distribution of all sub-time segment observations of all source address samples, calculating preset lower quantiles and preset upper quantiles to determine the endpoints of the truncation interval, and performing boundary replacement on extreme observations that exceed the truncation interval before linear scaling and normalization to the zero-to-one interval.

[0016] For the six-dimensional probability distribution vector of the signaling status code distribution characteristics, linear scaling is performed on each component with the minimum and maximum values ​​in all source address samples as the interval endpoints. When the minimum and maximum values ​​of a component are equal, the normalization result of the corresponding component is uniformly set to zero.

[0017] Preferably, the statistical fluctuation of the observed values ​​of each dimension of the extracted time-series feature sequence is used as the behavioral stability feature. The combination of the normalized aggregate feature and the normalized behavioral stability feature is mapped to discrete data points in the multi-dimensional feature space. This includes: calculating the standard deviation of the corresponding feature dimension on the normalized observed values ​​of all sub-time segments for each component of the normalized source address access frequency, registration request density and signaling status code distribution features as a behavioral stability index.

[0018] Using the component-wise extreme value linear scaling method, the minimum and maximum values ​​of the behavioral stability index corresponding to each source address in all source address samples are taken as the interval endpoints. The behavioral stability index is then subjected to linear scaling normalization and mapped to the zero-to-one interval to obtain the normalized behavioral stability index.

[0019] The arithmetic mean of the observations of each sub-time segment after normalization is used as the aggregation feature, and combined with the stability index of normalization behavior according to the fixed dimension arrangement rule to construct an enhanced multidimensional feature vector. The enhanced multidimensional feature vector corresponding to each source address is used as a discrete data point in the multidimensional feature space.

[0020] Preferably, the step of using a density-based spatial clustering algorithm to perform clustering analysis on discrete data points and extract normal business clusters includes: setting a preset neighborhood search radius parameter and a minimum neighborhood sample number parameter; traversing each discrete data point in the sample point set composed of all discrete data points; marking data points with a neighborhood sample number not less than the minimum neighborhood sample number parameter as core points; marking data points that fall within the neighborhood of core points but are not core points themselves as boundary points; and marking data points that are neither core points nor within the neighborhood of any core point as noise points.

[0021] Iterative merging of clusters is performed based on the density reachability relationship between core points, and the cluster with the most data points is selected from the resulting clusters and labeled as normal business clusters.

[0022] When there are multiple clusters containing the same number of data points, and each cluster has the largest number of data points, the cluster with the highest average density of internal data points is selected and labeled as the normal business cluster.

[0023] Preferably, the calculation of the weights of each dimension includes: calculating the cluster center coordinates of the normal business cluster as the arithmetic mean of the coordinate vectors of all discrete data points within the normal business cluster;

[0024] Calculate the variance of all discrete data points within the normal business cluster in each feature dimension. The adaptive weight of each feature dimension is determined based on the inverse relationship of the variance of the corresponding dimension.

[0025] Preferably, the step of generating a two-level interception threshold by combining boundary features includes: calculating the feature space distance between each discrete data point in the normal service cluster and the center of the normal service cluster using weighted Euclidean distance, arranging all distance values ​​in ascending order and extracting the distance value at the preset high quantile position as the boundary feature value;

[0026] A first-level safety margin coefficient is introduced to expand the boundary feature value to generate a first-level interception threshold. Based on the first-level interception threshold, a high-risk judgment multiplier is introduced to generate a second-level interception threshold.

[0027] The dual-level interception threshold adopts a periodic dynamic update mechanism, which re-executes feature extraction, cluster analysis and threshold calculation according to a preset period based on a new time window to track the evolution trend of normal business behavior patterns.

[0028] Preferably, the step of statistically analyzing the current source address time-series characteristics and calculating the weighted feature spatial distance includes: continuously capturing SIP signaling messages from the real-time access command and dispatch core switching device, and recording the current source address identifier and the corresponding message timestamp and method type in a real-time signaling log cache using a first-in-first-out ring storage structure;

[0029] The current sliding time window is determined with the current time as the endpoint and the preset sliding window duration as the span. Within the current sliding time window, the temporal characteristics of each active source address are statistically analyzed according to continuous sub-time segments. After normalization processing using the normalization parameters determined in the historical modeling stage, the data is mapped to real-time data points. The weighted feature space distance from the real-time data points to the normal business cluster center is calculated based on the adaptive weight vector.

[0030] Preferably, the distinction between medium-risk and high-risk anomaly levels based on the degree of distance deviation includes: when the real-time weighted feature spatial distance does not exceed the first-level interception threshold, the current source address is determined to be normal and no processing operation is triggered;

[0031] When the real-time weighted feature spatial distance exceeds the first-level interception threshold but does not exceed the second-level interception threshold, it is determined to be a medium-risk abnormal source address. The real-time feature statistical update cycle is shortened and signaling behavior is continuously observed. When the real-time weighted feature spatial distance exceeds the second-level interception threshold, it is determined to be a high-risk abnormal source address. Two parallel processing operations are initiated: bypass mirror forwarding and signaling blocking list issuance.

[0032] Preferably, the parallel execution of bypass mirroring forwarding and signaling blocking list distribution for high-risk abnormal source addresses includes: configuring a dedicated bypass mirroring forwarding strategy for high-risk abnormal source addresses at the session boundary controller, and copying and forwarding all signaling messages sent by the high-risk abnormal source addresses to an isolation sandbox that is logically isolated from the production network in real time.

[0033] Send a signaling blocking access control list carrying high-risk abnormal source address identification information to the session boundary controller, and perform rejection processing on subsequent signaling access requests from high-risk abnormal source addresses, thus moving the interception point of abnormal signaling to the network boundary.

[0034] Preferably, the protocol parsing of the mirrored message in the isolated sandbox includes: performing layer-by-layer protocol stack decoding on the mirrored message by sequentially encapsulating it with transport layer, SIP message layer, and session description protocol, and extracting three key types of information from the protocol field tree: message body content of SIP message layer, session description parameters, and authentication credential fields.

[0035] Based on a pre-defined attack feature rule base, feature pattern matching is performed on key information to identify different attack types.

[0036] Preferably, the method of identifying attack types and collaborative attack relationships by combining cross-source address association analysis includes: evaluating the degree of association between high-risk abnormal source addresses from three dimensions: time, attack target, and attack type; and marking multiple high-risk abnormal source addresses as a collaborative attack group when they simultaneously meet the collaborative attack determination conditions in at least two of the three evaluation dimensions.

[0037] The step of feeding back alarm results to update the boundaries of normal service clusters includes: maintaining a list of confirmed attack source addresses, removing data points corresponding to confirmed attack source addresses from the sample point set during periodic dynamic updates, re-performing cluster analysis and threshold calculation, and updating the list of confirmed attack source addresses.

[0038] Secondly, this application provides a SIP-based scheduling and management system for implementing the aforementioned SIP-based scheduling and management method, including: a signaling acquisition and parsing module, a feature normalization mapping module, a clustering threshold generation module, a real-time detection and processing module, and a deep analysis feedback module;

[0039] The signaling acquisition and parsing module acquires historical SIP signaling messages, parses the message header fields, and extracts the source address access frequency, registration request density, and signaling status code distribution characteristics of each source address to form a time-series feature sequence of each source address.

[0040] The feature normalization mapping module normalizes the temporal feature sequences of each source address, extracts the statistical fluctuation of the observation values ​​of each dimension of the temporal feature sequence as the behavioral stability feature, and combines the normalized aggregated feature with the normalized behavioral stability feature to map it into discrete data points in a multi-dimensional feature space.

[0041] The clustering threshold generation module uses a density-based spatial clustering algorithm to perform cluster analysis on discrete data points, extract normal business clusters, calculate the weights of each dimension, and generate a two-level interception threshold by combining boundary features.

[0042] The real-time detection and processing module collects current SIP signaling packets, statistically analyzes the timing characteristics of the current source address and calculates the weighted feature spatial distance, distinguishes between medium-risk and high-risk anomaly levels based on the degree of distance deviation, and performs parallel bypass mirror forwarding and signaling blocking list distribution for high-risk anomaly source addresses.

[0043] The deep analysis feedback module performs protocol parsing on the mirrored packets in the isolation sandbox, identifies attack types and collaborative attack relationships by combining cross-source address association analysis, generates and pushes structured security alarm events, and feeds back the alarm results to update the boundaries of normal business clusters.

[0044] The beneficial effects of this application are:

[0045] This application achieves a fine-grained and complete record of the evolution trajectory of source address signaling behavior by dividing a preset time window into continuous sub-time segments and extracting multiple types of signaling behavior features from each segment to form a time-series feature sequence. This solves the problem of losing time-series change information when signaling activities are aggregated into a single static feature vector.

[0046] This application eliminates dimensional differences by quantile truncation normalization and extracts the standard deviation as a behavioral stability feature. It combines this standard deviation with aggregate features to construct an enhanced feature vector, thereby achieving a unified quantitative expression of static behavioral patterns and dynamic temporal fluctuation information. This solves the problems of inconsistent feature scales and the difficulty in converting abnormal temporal fluctuation patterns into measurable feature dimensions.

[0047] This application automatically extracts normal business clusters through a density-based spatial clustering algorithm and determines the adaptive weights of each dimension based on the inverse of the variance within the cluster. Combined with boundary features, it generates a two-level interception threshold, realizing adaptive normal behavior boundary modeling without the need to preset the number of clusters. This solves the problem that fixed thresholds cannot adapt to the differences in the distribution of normal behavior in a multi-dimensional feature space.

[0048] This application uses a sliding window to statistically analyze features in real time and calculate weighted distances. It then performs tiered processing on abnormal source addresses based on dual-level thresholds, and performs parallel bypass mirroring and signaling blocking on high-risk source addresses. This enables timely tiered response to abnormal signaling and pre-interception at network boundaries, solving the problem that a single processing strategy cannot simultaneously ensure both detection accuracy and response timeliness.

[0049] This application identifies specific attack types and collaborative attack relationships through deep protocol parsing in an isolated sandbox and cross-source address association analysis. After confirming the results and removing abnormal data, the clustering model samples are purified, achieving accurate classification of attack behaviors and closed-loop self-optimization of the detection model. This solves the problems of difficulty in discovering collaborative attack relationships and the susceptibility of model boundaries to pollution and offset by historical abnormal data.

[0050] The technical solution of this application provides the SIP command and dispatch communication system with a closed-loop security protection capability covering the entire link, from historical behavior modeling, adaptive threshold generation, real-time hierarchical detection and handling to deep attack analysis and feedback. It effectively improves the automated defense level and emergency response efficiency of the command and dispatch communication network in complex and ever-changing signaling security threat environments, and meets the stringent requirements of command and dispatch scenarios for communication continuity and security reliability. Attached Figure Description

[0051] Figure 1 The flowchart of the SIP communication-based scheduling and management method provided in this application;

[0052] Figure 2 This is a schematic diagram of the signaling message acquisition architecture of this application;

[0053] Figure 3 This is a schematic diagram of the multidimensional feature space mapping of this application;

[0054] Figure 4 This is a schematic diagram of density-based spatial clustering analysis in this application;

[0055] Figure 5 This is a schematic diagram of the SIP communication command and dispatch scenario in this application;

[0056] Figure 6 The structure diagram of the SIP communication-based scheduling and management system provided in this application. Detailed Implementation

[0057] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the specific embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0058] Many specific details are set forth in the following description in order to provide a full understanding of this application. However, this application may also be implemented in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of this application. Therefore, this application is not limited to the specific embodiments disclosed below.

[0059] Secondly, the term "an embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of this application. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single embodiment or an embodiment selectively excluded from other embodiments.

[0060] Example 1

[0061] Reference Figures 1 to 5 This is the first embodiment of the present application, such as Figure 1 As shown, a SIP-based scheduling and management method is provided.

[0062] Step 1: Obtain historical SIP signaling messages, parse the message header fields, extract the source address access frequency, registration request density, and signaling status code distribution characteristics of each source address, and form a time-series feature sequence of each source address.

[0063] Specifically, in the command and dispatch communication process built on the SIP protocol, all terminal registration requests, call establishment requests, and session management requests are centrally processed through the command and dispatch core switching equipment (hereinafter referred to as the command and dispatch switching equipment). Under normal business operation, legitimate terminals exhibit inherent regularities in their signaling behavior over time: the signaling request sending rate, the concentration of registration operations, and the distribution of response status codes follow a relatively stable evolution trend within continuous time periods. If signaling activities within the entire time window are aggregated into a single static feature vector, the temporal variation information of signaling behavior between different time periods will be lost, thereby reducing the ability to identify attacks with abnormal temporal fluctuation patterns. Step 1 addresses this limitation by evenly dividing the preset time window into several continuous sub-time segments, extracting multiple types of behavioral features segment by segment at a fine-grained time scale, forming a complete temporal feature sequence that records the evolution trajectory of signaling behavior from each source address.

[0064] The signaling message acquisition process involves configuring a port mirroring interface on the signaling transmission link of the command and dispatch switching equipment. This mirrors all SIP signaling messages flowing through the transmission link to a separately deployed signaling acquisition server. The port mirroring interface operates at the physical or data link layer, performing lossless copying of the original signaling messages without altering their transmission path, timing, or content integrity, ensuring uninterrupted normal signaling services on the command and dispatch switching equipment. Upon receiving the mirrored messages, the signaling acquisition server performs deduplication filtering based on the sequence number and acknowledgment number fields in the message transport layer protocol header, eliminating duplicate messages introduced by link retransmission mechanisms or port mirroring configuration redundancy. Simultaneously, using its own synchronized standard clock source as a reference, it timestamps the reception time of each SIP signaling message, ensuring all messages are time-stamped to the same time base, preventing clock drift from causing systematic deviations in subsequent timing characteristic statistics. After deduplication and timestamp calibration, the signaling acquisition server segments and archives the messages according to a preset time window, forming a time-series-based historical SIP signaling message dataset. The selection of the preset time window duration must ensure that the historical samples reflect the complete cyclical changes of the business model: a duration that is too short will result in an insufficient number of historical samples; a duration that is too long will introduce a large amount of outdated old business data, reducing the timeliness of the modeling samples. For example, the preset time window duration can be set to 24 hours to fully cover one work cycle of command and dispatch operations, ensuring the representativeness and completeness of the historical samples.

[0065] Figure 2 This demonstrates the overall architecture for signaling message acquisition; Figure 2 The left side of the center section contains a command and dispatch terminal cluster, comprising multiple terminal devices connected to the central command and dispatch core switching equipment via SIP signaling streams. Below the core switching equipment is a port mirroring interface, which mirrors signaling packets to a separately deployed signaling acquisition server using lossless replication. The signaling acquisition server performs deduplication filtering, timestamp calibration, segmented archiving, and standard clock synchronization, ultimately outputting a time-series-based historical SIP signaling packet dataset. Figure 2 The preset time window (24 hours in the example) is marked in the upper right corner, and the normal service forwarding path is marked as uninterrupted on the right side of the core switching equipment. The overall architecture reflects the design principles of bypass acquisition, lossless mirroring, and independent processing.

[0066] After obtaining the historical SIP signaling message dataset, the preset time window is evenly divided into several consecutive, non-overlapping sub-time segments. For each message in the historical SIP signaling message dataset, the From field of the SIP protocol header is parsed to obtain the initiator identification information, and the CSeq field is parsed to obtain the request method type information. The From field contains the initiator's SIP URI, constituting the source address information that uniquely identifies the source of the signaling; the method name in the CSeq field directly reflects the operational intent of the signaling, used to distinguish different signaling operation types such as REGISTER, INVITE, BYE, and OPTIONS. The number of sub-time segments is related to both the preset time window duration and the minimum observable change period of the signaling activities in the command and dispatch communication system. If the number of segments is too small, each sub-time segment covers a long period, resulting in excessive smoothing of temporal change information and a decrease in the accuracy of the representation of behavioral stability features; if the number of segments is too large, the number of message samples within each sub-time segment is insufficient, and the feature statistics results are greatly affected by random fluctuations. For example, when the preset time window duration is 24 hours, the preset time window can be evenly divided into 24 consecutive sub-time segments, each sub-time segment covering one hour, capturing the temporal evolution pattern of signaling behavior at the hourly granularity.

[0067] Based on the source address information extracted from the From field, all packets in the historical SIP signaling packet dataset are grouped and aggregated by source address. For each independent source address, three types of features are statistically analyzed within each sub-time segment. The first feature is the source address access frequency, defined as the ratio of the total number of SIP signaling requests sent by the corresponding source address within the sub-time segment to the duration of the sub-time segment. This represents the signaling load intensity generated by the source address on the command and dispatch switching equipment during the time period. Under normal business scenarios, the source address access frequency of legitimate terminals is within a relatively stable range, while the source address access frequency of malicious attack source addresses is significantly higher due to the large number of signaling packets sent in a short period. The second feature is the registration request density, defined as the ratio of the number of REGISTER type requests sent by the corresponding source address within the sub-time segment to the total number of requests within the same time period. This represents the proportion of registration operations in all signaling activities of the source address. Under normal business scenarios, the proportion of REGISTER requests is low, while the registration request density will be significantly higher in registration flooding attacks or authentication brute-force attacks. The third type of feature is the signaling status code distribution feature. It counts the frequency of occurrence of various response status codes in all signaling response messages triggered by the corresponding source address within the sub-time segment. According to the SIP protocol specification, it is converted into a six-dimensional probability distribution vector into six categories: 1xx temporary response, 2xx success response, 3xx redirection response, 4xx client error response, 5xx server error response, and 6xx global fault response. Each component represents the proportion of the corresponding category of response code in all responses during the time period.

[0068] After completing the statistical analysis of the three types of features for each sub-time segment, each source address forms a set of feature observation sequences arranged in chronological order within a preset time window, namely, the time sequence feature sequence. This sequence fully records the evolution trajectory of the source address signaling behavior in each time period within the preset time window, providing continuous observation data in the time dimension for the extraction of behavioral stability features in subsequent steps.

[0069] Step 2: Normalize the temporal feature sequences of each source address, extract the statistical fluctuation of each dimension of the temporal feature sequence as the behavioral stability feature, and combine the normalized aggregate feature with the normalized behavioral stability feature to map it into discrete data points in a multi-dimensional feature space.

[0070] The three types of features in the time-series feature sequence differ significantly in the units and ranges of their original values: source address access frequency is a rate value, and its value range may span multiple orders of magnitude; registration request density is a ratio-type feature, with values ​​limited to zero and one; and all components of the signaling status code distribution feature are between zero and one, and the sum of all components is one. If the original features are directly used for subsequent distance calculations, the source address access frequency, with its larger value range, will dominate the measurement, masking the differences carried by the registration request density and signaling status code distribution features, leading to an imbalance in the clustering analysis results. Therefore, it is necessary to perform normalization processing on each type of feature separately.

[0071] For all sub-time segment observations of scalar features, source address access frequency and registration request density, in the time-series feature sequence, a normalization method combining quantile truncation and linear scaling is adopted. The numerical distributions of source address access frequency and registration request density across all sub-time segment observations of all source address samples covered by the historical SIP signaling message dataset are statistically analyzed. Preset lower and upper quantiles are calculated to determine the endpoints of the truncation interval. Boundary replacement is performed on extreme observations exceeding the truncation interval to suppress the interference of a small number of extreme outliers on the estimation of normalization parameters, avoiding excessive concentration of the normalized numerical distribution within a narrow interval due to individual extreme samples. Linear scaling is then applied to the truncated observations, normalizing the observations of each sub-time segment to the interval between zero and one. The normalization calculation method is as follows: ;in, This represents the raw observation value of the source address access frequency or registration request density within the k-th sub-time segment, after quantile truncation. This represents the cutoff boundary value corresponding to the preset lower quantile calculated over all sub-time segment observations of the entire source address sample. This represents the cutoff boundary value corresponding to the preset upper quantile calculated over all sub-time segment observations of the corresponding feature across all source address samples. This represents the normalized sub-time segment observations. The selection of the preset lower quantile and preset upper quantile needs to strike a balance between suppressing extreme value interference and preserving the main numerical range. For example, the preset lower quantile can be taken as the first percentile, and the preset upper quantile can be taken as the 99th percentile. The numerical range distributed by 98% of the observations in all source address samples is used as the normalization benchmark to ensure that the extreme value truncation operation does not affect the normalization accuracy of the vast majority of samples.

[0072] For the six-dimensional probability distribution vector in the signaling status code distribution characteristics, linear scaling is performed on each component, using the minimum and maximum values ​​of each component across all sub-time segments of observations in all source address samples as interval endpoints, mapping each component to the zero-to-one interval. When the minimum and maximum values ​​of a component across all source address samples are equal, it indicates that there is no statistical difference in the corresponding category of response status codes across all source addresses. The normalization results for the corresponding component are then uniformly set to zero to avoid introducing meaningless numerical disturbances in subsequent distance calculations.

[0073] After normalizing the observations for each sub-time segment, the statistical fluctuation of each dimension of the normalized temporal feature sequence is calculated for each source address, serving as a behavioral stability feature to characterize the degree of behavioral stability. The rationale for introducing behavioral stability features is that, under normal business scenarios, the signaling behavior of legitimate terminals maintains a relatively stable evolution rhythm between sub-time segments, with temporal fluctuations in feature observations at a low level. However, in attack scenarios such as registration flooding attacks and authentication brute-force attacks, the attack source address often experiences a concentrated burst of a large number of abnormal signaling requests within a very short period, causing drastic jumps in feature observations between sub-time segments. Aggregated features alone cannot capture such temporal anomalies, while behavioral stability features can transform this abnormal temporal pattern into quantifiable feature dimensions.

[0074] For each component of the normalized source address access frequency, registration request density, and signaling status code distribution characteristics, the standard deviation of that feature dimension over the normalized observations of all sub-time segments is calculated. This standard deviation serves as the behavioral stability index for the corresponding feature dimension, i.e., a numerical measure of the behavioral stability feature across each specific dimension. The calculation method is as follows:

[0075] ;

[0076] in, The behavior stability index represents the j-th feature dimension in a temporal feature sequence of a certain source address, i.e., the standard deviation of this dimension over the normalized observations of all sub-time segments. This indicates the total number of sub-time segments divided within the preset time window. This represents the normalized observation value of the j-th feature dimension within the k-th sub-time segment corresponding to the source address. This represents the arithmetic mean of the j-th feature dimension of the corresponding source address across all K sub-time segments of normalized observations. After calculation, the behavioral stability index is normalized using a component-wise extreme value linear scaling method. The minimum and maximum values ​​of the behavioral stability index corresponding to each source address in all source address samples are used as the interval endpoints to uniformly map all behavioral stability indices to the zero-to-one interval, eliminating scale differences between different feature dimensions.

[0077] After normalizing all features, the normalized aggregate features (the arithmetic mean of the normalized observations in each sub-time segment) and the normalized behavioral stability features are combined according to a fixed dimensional arrangement rule to construct an enhanced multidimensional feature vector. Specifically, the arithmetic mean of the normalized source address access frequency over all sub-time segments is used as the first dimension component of the enhanced multidimensional feature vector; the arithmetic mean of the normalized registration request density over all sub-time segments is used as the second dimension component; the arithmetic mean of each component of the normalized signaling status code distribution feature over all sub-time segments is used as the third to eighth dimension components in sequence; the normalized source address access frequency behavioral stability index is used as the ninth dimension component; the normalized registration request density behavioral stability index is used as the tenth dimension component; and the behavioral stability index of each component of the normalized signaling status code distribution feature is used as the eleventh to sixteenth dimension components in sequence, thus forming a 16-dimensional enhanced multidimensional feature vector. Each source address is represented by a 16-dimensional enhanced multidimensional feature vector as a discrete data point in the multidimensional feature space. All discrete data points corresponding to the source addresses together constitute a set of sample points in the multidimensional feature space, providing data input with uniform dimensions, consistent scale, and both static aggregation characteristics and dynamic temporal stability information for the clustering analysis in step 3.

[0078] Figure 3 The data distribution pattern in the multidimensional feature space is illustrated using a two-dimensional projection method: solid black dots represent normal source address data points that are densely clustered in the feature space, hollow circles represent abnormal source address data points that are sparsely distributed far from the dense areas, and dashed ellipses mark the dense areas of normal business, which intuitively reflects the difference in the distribution of normal and abnormal source addresses in the feature space.

[0079] Step 3: Use a density-based spatial clustering algorithm to perform cluster analysis on discrete data points, extract normal business clusters, calculate the weights of each dimension, and generate a two-level interception threshold by combining boundary features.

[0080] Specifically, in command and dispatch communication, the signaling behavior patterns of normal service source addresses are similar, and the corresponding discrete data points tend to cluster into dense regions in the multidimensional feature space. Abnormal source addresses, due to their signaling behavior deviating from the normal pattern, typically have their corresponding discrete data points distributed in sparse locations far from these dense regions. Density-based spatial clustering algorithms do not require pre-specifying the number of clusters and can discover dense regions of arbitrary shapes in the multidimensional feature space, identifying data points in sparse locations as noise. This approach is suitable for signaling behavior feature analysis scenarios where normal source addresses are concentrated while abnormal source addresses are scattered.

[0081] Density-based spatial clustering algorithms require pre-setting a neighborhood search radius parameter and a minimum neighborhood sample number parameter. The neighborhood search radius parameter defines the search range when searching for a neighborhood centered on a discrete data point. It can be determined by sorting the k-th nearest neighbor distances of each data point in the sample point set and taking the distance value corresponding to the inflection point of the sorting curve, where k is the value of the minimum neighborhood sample number parameter. The minimum neighborhood sample number parameter defines the minimum number of data points in the neighborhood required to identify a discrete data point as a core point. Its reasonable value is related to the dimension of the feature space; the higher the dimension of the feature space, the larger the minimum neighborhood sample number is required to ensure the statistical reliability of the density estimation. For example, the minimum neighborhood sample number parameter can be taken as the dimension of the multidimensional feature space multiplied by two plus one. In the current 16-dimensional enhanced feature space, the corresponding value is 33, ensuring that the neighborhood of the core point contains a sufficient number of samples to support the density estimation.

[0082] After setting the parameters, each discrete data point in the sample point set is traversed, and the number of other data points (i.e., the number of neighborhood samples) within the hypersphere centered on each discrete data point and with the neighborhood search radius parameter as the radius is counted. Discrete data points with a neighborhood sample number not less than the minimum neighborhood sample number parameter are marked as core points, and all data points within the neighborhood of a core point are assigned to the same cluster with the core point as the seed. Discrete data points with a neighborhood sample number less than the minimum neighborhood sample number parameter but falling within the neighborhood of a core point are marked as boundary points and assigned to the cluster containing the corresponding core point. Discrete data points that are neither core points nor within the neighborhood of any core point are marked as noise points. After marking all data points, the clusters are iteratively merged based on the density reachability relationship between the core points until no new merging operations are generated, ultimately forming several clusters and a set of noise points. From the resulting clusters, the cluster containing the most discrete data points is selected as a candidate for normal service clusters. If multiple clusters contain the same number of discrete data points, the cluster with the highest average density of internal data points is further selected. The finally selected cluster is labeled as the normal service cluster, representing the dominant normal signaling service behavior pattern in command and dispatch communication.

[0083] Figure 4 The process and results of the density-based spatial clustering algorithm in step 3 for clustering analysis of multidimensional feature space data points are shown. Specifically, it is a two-dimensional projection diagram of the feature space. The normal business cluster is located inside the large dashed ellipse, which contains a large number of solid circle core points and hollow circle boundary points. The center of the cluster is marked with a cross O, and the neighborhood search radius ε is indicated by a small dashed circle. The crosses scattered far from the dense area are noise points (abnormal source addresses). There is also a small cluster. Figure 4 The following diagrams list the illustrations in order, including the core point, boundary point, noise point, cluster center, and neighborhood radius.

[0084] After calibrating the normal service clusters, the cluster center coordinates of the normal service clusters are calculated as follows:

[0085] ;in, This represents the coordinate vector of the center of the normal business cluster in the 16-dimensional enhanced feature space. This represents the total number of discrete data points contained in a normal business cluster. This represents the coordinate vector of the i-th discrete data point in the normal service cluster. The center of the normal service cluster represents the centroid position of the behavioral patterns of all normal service source addresses in the multidimensional feature space.

[0086] The inherent consistency of normal business behavior varies across different feature dimensions. If all dimensions are weighted equally for distance measurement, dimensions with higher variance will dominate the distance calculation, while the contribution of dimensions with lower variance but strong discriminative power against abnormal behavior will be suppressed. For feature dimensions with high variance within normal business clusters, the values ​​of normal source addresses themselves exhibit significant natural fluctuations in this dimension, limiting its ability to distinguish between normal and abnormal behavior; therefore, it should be assigned a lower weight in the distance measurement. Conversely, for feature dimensions with low variance within normal business clusters, the values ​​of normal source addresses are highly consistent; any deviation in this dimension strongly indicates anomaly and should be assigned a higher weight in the distance measurement. Based on the above analysis, the adaptive weights of each feature dimension are determined according to the inverse relationship of the variance within the normal business cluster:

[0087] ;in, This represents the adaptive weight coefficient of the j-th feature dimension after normalization. This represents the variance of all discrete data points within a normal business cluster on the j-th feature dimension. M represents the total number of dimensions in the multidimensional feature space (M is 16 in a 16-dimensional enhanced feature space), and l is the summation index for traversing all dimensions. This is the sum of the reciprocals of the variances of all dimensions, used to normalize the weights of each dimension so that the sum of the components of the weight vector equals one. When the variance of a certain dimension within the normal business cluster is zero (i.e., all normal source addresses have the same value in this dimension), the variance of this dimension is replaced with a preset very small positive number to avoid division by zero anomalies, so that the adaptive weight of the corresponding dimension tends to the maximum value, reasonably reflecting the strong anomaly discrimination capability of this dimension.

[0088] Based on adaptive weights, the weighted Euclidean distance is used to calculate the feature space distance between each discrete data point in the normal service cluster and the center of the normal service cluster:

[0089] ;in, This represents the weighted feature space distance from the i-th discrete data point in the normal service cluster to the center of the normal service cluster. Represents the coordinate vector of the i-th discrete data point. The normalized component value on the j-th feature dimension, Represents the coordinate vector of the center of the normal business cluster The component value in the j-th feature dimension, The adaptive weighting coefficient for the j-th feature dimension is determined by normalization using the inverse of variance. The weighted feature space distance values ​​corresponding to all discrete data points in the normal service cluster are sorted in ascending order, and the distance value at the preset high quantile position is extracted as the boundary feature value of the normal service cluster. The selection of the preset high quantile position affects the coverage looseness of the normal service cluster boundary: a higher value results in a looser boundary and a higher proportion of normal source address samples, but it also includes some slightly deviating abnormal source addresses within the normal range; a lower value results in a stricter boundary and higher sensitivity to detecting slightly deviating behavior, but the probability of misjudging normal edge source addresses increases accordingly. For example, the preset high quantile position can be taken as the 95th percentile, that is, using the upper limit of the weighted feature space distance corresponding to 95% of the discrete data points within the normal service cluster as the boundary feature value, ensuring that the vast majority of normal source addresses are correctly covered while retaining the ability to detect slightly deviating behavior.

[0090] After obtaining the boundary feature values, a first-level safety margin coefficient is introduced to expand the boundary feature values, generating a first-level interception threshold used to distinguish between normal and medium-risk anomalies: ;in, This indicates the first-level interception threshold. This represents the boundary characteristic value of the normal business cluster. This represents the primary security margin coefficient, used to reserve fault tolerance space for legitimate source addresses near the boundary in normal operations. A larger primary security margin coefficient results in a more lenient primary interception threshold and a lower probability of misclassifying normal edge source addresses, but a corresponding decrease in the sensitivity to detect slightly abnormal source addresses; a smaller value results in higher detection sensitivity, but a corresponding increase in the risk of misclassifying normal edge source addresses. For example, the primary security margin coefficient can be set to 0.2, meaning the primary interception threshold is 1.2 times the boundary feature value. Based on the primary interception threshold, a high-risk judgment multiplier is further introduced to generate the secondary interception threshold: ;in, Indicates the secondary interception threshold. This represents the high-risk determination ratio, used to define the boundary between the medium-risk warning interval and the high-risk mandatory handling interval. A higher high-risk determination ratio results in a higher distance deviation threshold for triggering mandatory blocking, meaning only source addresses with extremely significant deviations will enter the high-risk handling process. A lower value makes the high-risk determination more sensitive, but may increase the frequency of mandatory handling for source addresses with moderate deviations. For example, a high-risk determination ratio of 1.5 can be used, meaning that when the weighted feature space distance corresponding to a source address exceeds 1.5 times the first-level interception threshold, it is determined to be a high-risk abnormal source address.

[0091] To adapt to the gradual evolution of signaling service modes in command and dispatch communication systems over time, a periodic dynamic update mechanism is adopted for the two-level interception thresholds. When the preset time window rolls forward according to the preset cycle, the signaling acquisition server re-executes all processes from steps 1 to 3 based on the new time window. It re-completes feature extraction, normalization parameter determination, cluster analysis, adaptive weight calculation, and boundary feature extraction based on the new historical SIP signaling message dataset, and regenerates the primary and secondary interception thresholds, ensuring that the two-level interception thresholds track the evolution trend of normal service behavior patterns. For example, the preset cycle can be 24 hours, meaning that a full dynamic update of the two-level interception thresholds is performed every 24 hours, ensuring the timeliness of modeling while keeping the computational resource consumption of the rolling update within a reasonable range.

[0092] Step 4: Collect the current SIP signaling packets, statistically analyze the timing characteristics of the current source address and calculate the weighted feature spatial distance. Based on the degree of distance deviation, distinguish between medium-risk and high-risk anomaly levels. For high-risk anomaly source addresses, perform parallel bypass mirror forwarding and signaling blocking list distribution.

[0093] Specifically, after completing historical modeling and dynamic generation of the two-level interception threshold, the process enters the real-time signaling detection and graded handling stage. Step 4, based on the adaptive weight vector, normal service cluster center coordinate vector, and two-level interception threshold determined in Step 3, performs sliding time window feature statistics and anomaly level determination on the SIP signaling packets accessed in real time on the command and dispatch switching equipment, and implements differentiated handling measures for anomaly source addresses with different risk levels.

[0094] In the real-time signaling message acquisition phase, the port mirroring interface configured in step 1 is continued to capture SIP signaling messages that are accessing the command and dispatch switching equipment in real time. The signaling acquisition server parses the From field of the SIP protocol header for each captured message to extract the current source address identifier, and records the current source address identifier along with the corresponding message timestamp and method type in the real-time signaling log cache. The real-time signaling log cache adopts a first-in-first-out circular storage structure, retaining only message records within the current sliding time window range; historical records outside the range are automatically discarded to control memory usage and maintain the real-time performance of the sliding window. The current sliding time window is determined by the current moment as the endpoint and a preset sliding window duration as the span. Within the current sliding time window, it is evenly divided into continuous sub-time segments according to a preset number of real-time sub-time segments. For each active source address, the source address access frequency, registration request density, and signaling status code distribution characteristics are statistically analyzed for each sub-time segment, forming a real-time time-series characteristic sequence of the current source address.

[0095] The selection of the preset sliding window duration must balance the requirements of both timely detection and stable feature statistics. If the sliding window duration is too short, the number of message samples within each sub-time segment will be insufficient, making feature statistics susceptible to instantaneous fluctuations, and normal business disruptions may falsely trigger anomaly detections. If the sliding window duration is too long, the detection delay will increase, and sudden attacks may not be detected in a timely manner. For example, a preset sliding window duration of 5 minutes can be used. The selection of the preset number of real-time sub-time segments must ensure that each sub-time segment covers a sufficient number of signaling messages to support the reliability of statistical calculations. At the same time, the number of sub-time segments should not be too small to ensure sufficient temporal observation samples for calculating behavioral stability features. For example, when the preset sliding window duration is 5 minutes, the preset number of real-time sub-time segments can be 5, with each sub-time segment covering 1 minute. This captures the temporal fluctuation characteristics of real-time signaling behavior at the minute-level granularity, while ensuring that each sub-time segment has a sufficient number of message samples to support feature statistics.

[0096] After obtaining the real-time time-series feature sequence of the current source address, the normalization parameters (quantile truncation boundary values ​​and extreme values ​​of each component) determined in step 2 (historical modeling stage) are used to normalize the observation values ​​of each sub-time segment of the current source address. Behavioral stability features are extracted from the normalized real-time time-series feature sequence. Following the dimensional arrangement rules determined in step 2, the normalized aggregated features and normalized behavioral stability features are combined into a 16-dimensional real-time data point coordinate vector, mapped to a real-time data point in a multi-dimensional feature space. The real-time feature data is processed using the normalization parameters determined in the historical modeling stage to ensure comparability between real-time data points and normal service clusters in the same coordinate system, guaranteeing the effectiveness of the two-level interception threshold discrimination. Using the adaptive weight vector determined in step 3 and the coordinates of the normal service cluster center, the weighted feature space distance from the real-time data point to the center of the normal service cluster is calculated according to the weighted Euclidean distance calculation method in step 3. The resulting distance value is completely consistent with the distance metric used to calculate the boundary feature value in step 3.

[0097] After obtaining the real-time weighted feature spatial distance of the current source address, the real-time weighted feature spatial distance is compared with the first-level interception threshold and the second-level interception threshold. Based on the degree of deviation, the source address is divided into three judgment results. When the real-time weighted feature spatial distance does not exceed the first-level interception threshold, the signaling behavior of the current source address is determined to be within the normal range, and no action is triggered. The signaling messages of the current source address are forwarded and processed normally in the command and dispatch switching equipment. If the source address was previously in a medium-risk observation state, the medium-risk observation mark is simultaneously revoked, and its feature statistics update cycle is restored to the normal cycle. When the real-time weighted feature spatial distance exceeds the first-level interception threshold but does not exceed the second-level interception threshold, the current source address is determined to be a medium-risk abnormal source address. The system shortens the real-time feature statistical update cycle for the medium-risk abnormal source address, increases the execution frequency of feature data collection and distance calculation, and continuously monitors whether the signaling behavior of the medium-risk abnormal source address further deteriorates, so as to upgrade the handling measures in a timely manner. If the real-time weighted feature spatial distance of the medium-risk abnormal source address does not exceed the first-level interception threshold within a consecutive preset observation round (for example, the preset observation round can be 3 rounds), then its behavior is determined to have returned to normal, the medium-risk observation status is revoked, and the regular monitoring cycle is restored. When the real-time weighted feature spatial distance exceeds the second-level interception threshold, the current source address is determined to be a high-risk abnormal source address, and two parallel handling operations of bypass mirror forwarding and signaling blocking are immediately initiated.

[0098] For high-risk abnormal source addresses, the first parallel processing operation is bypass mirroring forwarding. At the session boundary controller or network signaling entry point, a dedicated bypass mirroring forwarding policy is configured for the high-risk abnormal source address. This policy copies and forwards the currently processed signaling packets and all subsequent continuously sent signaling packets from the high-risk abnormal source address to the isolation sandbox in real time. The isolation sandbox is an independently deployed security analysis environment, logically isolated from the production network of the command and dispatch switching equipment. The storage and analysis of high-risk abnormal signaling packets in the isolation sandbox will not affect the normal business processing of the command and dispatch switching equipment, while providing complete raw packet data for deep protocol parsing and attack type identification in step 5.

[0099] The second parallel processing operation is the issuance of a signaling blocking access control list. A signaling blocking access control list carrying high-risk abnormal source address identifiers is issued to the session boundary controller deployed at the signaling entry point of the command and dispatch communication system. The session boundary controller, based on the signaling blocking access control list, rejects subsequent signaling access requests from high-risk abnormal source addresses, preventing signaling packets from these addresses from continuing to enter the signaling processing flow of the command and dispatch switching equipment. The signaling blocking operation moves the interception point of abnormal signaling to the network boundary at the session boundary controller level, preventing high-risk abnormal signaling packets from penetrating into the core switching equipment and consuming processing resources. The bypass mirroring and signaling blocking access control list issuance operations are performed in parallel. Bypass mirroring synchronously replicates packets at the blocking point, ensuring that subsequent in-depth analysis can obtain complete samples of high-risk abnormal packets. Simultaneously, the signaling blocking operation cuts off the signaling access path from the high-risk abnormal source address to the core switching equipment, preventing high-risk abnormal signaling from continuously consuming core processing resources.

[0100] Step 5: Perform protocol parsing on the mirrored packets in the isolation sandbox, identify attack types and collaborative attack relationships by combining cross-source address association analysis, generate and push structured security alert events, and feed back the alert results to update the boundaries of normal business clusters.

[0101] Step 5 involves performing deep protocol analysis on the high-risk abnormal signaling messages from the bypass mirroring in Step 4 within an isolated sandbox. Building upon the identification of single-source address attack types, cross-source address correlation analysis is further introduced to discover collaborative attack relationships. The identification results are pushed to the command and dispatch management platform in the form of structured security alarm events. Confirmed attack alarm results are fed back to purify the construction data of normal business clusters, forming a closed-loop optimization mechanism for the entire method.

[0102] Specifically, deep protocol parsing starts from the transport layer, sequentially decoding the UDP or TCP transport layer encapsulation, the SIP message layer encapsulation, and the session description protocol encapsulation embedded in the SIP message body, layer by layer, to restore the complete structure of each signaling message into a hierarchical protocol field tree. Three types of key information are extracted from the protocol field tree: the first type is the message body content of the SIP message layer, including the method type and target URI in the request line, key-value pairs of various standard header fields (From, To, Call-ID, CSeq, Via, Contact, etc.), and the message body payload data; the second type is the session description parameters, including parameters related to media session negotiation such as media type, transport address, encoding format, and connection information in the session description protocol; the third type is the authentication credential fields, including digest authentication parameters carried by the Authorization or Proxy-Authorization fields, username information, and authentication response values, etc., related to authentication. Deep protocol parsing delves into the message body and session description to perform a complete restoration of protocol semantics, obtaining more granular signaling behavior features than the message header field parsing in step 1, providing sufficient protocol semantic information for subsequent attack feature pattern matching.

[0103] Based on a pre-defined attack feature rule base, feature pattern matching is performed on the three types of key information extracted. The attack feature rule base predefines feature pattern descriptions for four known SIP attack types: registration flooding attack, call spoofing attack, authentication brute-force attack, and signaling malformed message attack. Each attack type corresponds to a set of matching rules composed of protocol field feature conditions. The characteristic patterns of registration flooding attacks are as follows: a high-risk abnormal source address sends a large number of REGISTER requests intensively within a very short time interval, and the registration validity period parameter value carried in the requests is abnormally large or small; the characteristic patterns of call spoofing attacks are as follows: the From or Contact field in the INVITE request contains forged source identification information, and the media connection address in the session description parameter is inconsistent with the signaling layer source address; the characteristic patterns of authentication brute-force attacks are as follows: the same source address repeatedly sends REGISTER requests with different authentication response values ​​to the same or multiple target usernames, accompanied by a large number of 401 or 407 authentication failure response status codes; the characteristic patterns of signaling malformed message attacks are as follows: the signaling message contains malformed header fields that do not conform to the SIP protocol specification, excessively long field values ​​that exceed the length limit of the protocol specification, or message content containing illegal character encoding, intending to trigger protocol parsing anomalies in the command and dispatch switching equipment. The three types of key information extracted are compared one by one with the matching rules in the attack feature rule base. When the extracted key information meets all the feature conditions corresponding to a certain attack type, the attack behavior of the high-risk abnormal source address is classified into the corresponding attack type. The attack behavior of a high-risk abnormal source address can be identified as one or more of the above four attack types.

[0104] After identifying the attack type of a single high-risk anomaly source address, cross-source address correlation analysis is further performed on all high-risk anomaly source addresses within the current time window to discover potential coordinated attack relationships. Coordinated attacks refer to multiple attack source addresses coordinating in time to launch a joint attack on the same target or undertaking different attack sub-tasks. Compared with independent attacks from a single source address, these attacks are more dangerous and more concealed, and conventional single-source address analysis methods are insufficient to identify the collaborative relationships between attacker groups. Cross-source address correlation analysis assesses the degree of correlation between high-risk anomaly source addresses from three dimensions: time, attack target, and attack type. In terms of time, the proximity of the times when different high-risk anomaly source addresses first trigger high-risk judgments is statistically analyzed. If the times when multiple high-risk anomaly source addresses first trigger high-risk judgments all fall within the same preset collaborative judgment time window (e.g., a preset collaborative judgment time window of 5 minutes), then there is suspicion of a collaborative attack in the time dimension. In terms of attack target dimension, the overlap between the request target URI extracted from deep protocol parsing of different high-risk anomaly source addresses and the attacked user identifier is compared. If multiple high-risk anomaly source addresses launch attacks against the same target, then there is a collaborative relationship in the attack target dimension. In terms of attack type dimension, the attack types and specific rule matching details identified by feature pattern matching of different high-risk anomaly source addresses are compared. If multiple high-risk anomaly source addresses exhibit highly similar attack feature patterns, then there is a behavioral similarity association in the attack type dimension. When multiple high-risk anomaly source addresses simultaneously meet the collaborative attack judgment conditions in at least two of the three evaluation dimensions, the corresponding source address group is marked as a collaborative attack group. The member identifiers of the collaborative attack group and the evidence information of the association dimension will be included in the security alarm event message.

[0105] After completing the attack type identification and cross-source address correlation analysis, the isolation sandbox generates a structured security alert event message, which includes the following key information fields: the identification information of the high-risk abnormal source address (the SIP URI or IP address corresponding to the high-risk abnormal source address determined in step 4), the identified attack type identifier, the start timestamp of the attack behavior, the signaling session identifier involved (the Call-ID identifier information of each signaling session initiated by the high-risk abnormal source address within the current sliding time window), the threat severity label, and the cross-source address correlation analysis conclusion (if there is a coordinated attack group, a list of members of the coordinated attack group and a description of the correlation dimensions are attached). Threat severity labels are comprehensively assessed based on the severity of the attack type and the deviation of the real-time weighted feature spatial distance corresponding to the high-risk anomaly source address from the secondary interception threshold, and are divided into three severity levels: Emergency, Severe, and General. When the attack type is a registration flooding attack or authentication brute-force attack and the real-time weighted feature spatial distance exceeds a preset high multiple of the secondary interception threshold, it is marked as Emergency (e.g., a preset high multiple of 3 times). When the attack type is clear and the distance deviation is within a moderate range, it is marked as Severe. When the attack type is a signaling malformation attack or similar attack with relatively limited severity and a small distance deviation, it is marked as General. The isolation sandbox pushes structured security alarm event messages to the command and dispatch management platform through a preset encrypted transmission channel. After receiving the security alarm event messages, the command and dispatch management platform archives all field information to the security event database and visualizes it on the security monitoring interface as an alarm list, threat topology map, or time-series trend chart, enabling security management personnel to promptly understand the current signaling security threat status of the system and providing a basis for the formulation and adjustment of subsequent security response strategies.

[0106] After the security alert event is pushed, the alert results of high-risk abnormal source addresses confirmed by attack type identification are fed back to the clustering model. This is used to purify the construction data of normal service clusters during subsequent periodic dynamic updates. The feedback mechanism maintains a list of confirmed attack source address records, which records all high-risk abnormal source address identifiers confirmed by attack type identification in step 5. During the periodic dynamic update execution in step 3, discrete data points corresponding to the source addresses listed in the confirmed attack source address record list are removed from the sample point set corresponding to the historical SIP signaling message dataset. Based on the purified sample point set after removal, clustering analysis, normal service cluster extraction, adaptive weight calculation, and boundary feature extraction are re-executed. This ensures that the calculation basis of the interception threshold is always composed of the behavioral feature data of normal service source addresses, preventing historical abnormal source address data points that have been confirmed as attack behavior from being mistakenly included in the normal service cluster during the next update, thereby avoiding the boundary of the normal service cluster from being polluted by abnormal data and shifting in the abnormal direction. The list of confirmed attack source addresses is updated according to a preset validity period. Entries that have exceeded the validity period are automatically deleted. For example, the preset validity period can be 30 days to adapt to changes in the identity between normal source addresses and historical attack source addresses in scenarios such as IP address reallocation. This avoids legitimately reallocated IP addresses being excluded from the normal business cluster construction data for a long time because they appear in historical attack records, which would affect the long-term stability and accuracy of the detection model.

[0107] Figure 5 The document demonstrates a complete deployment scenario of the SIP-based communication scheduling management method in a real command and dispatch communication system. Figure 5 The left side of the network is the external access area, which includes legitimate terminals (command consoles, dispatch consoles, mobile terminals, and substation equipment) and attack sources (registered flood attack source A, brute-force attack source B, and coordinated attack member C). A Session Border Controller (SBC) is deployed at the network boundary to perform signaling blocking ACL filtering, denying access to attack sources already listed in the blocking list, while allowing legitimate terminals to pass. Figure 5 The central section houses the core switching equipment for command and dispatch, configured with port mirroring interfaces to losslessly copy signaling to the signaling acquisition server for real-time feature statistics and distance determination. High-risk abnormal packets are mirrored and forwarded to an independent isolation sandbox for in-depth analysis. The analysis results are pushed to the bottom command and dispatch management platform (alarm list, threat topology, trend charts) via an encrypted channel. Security administrators use the platform for monitoring, response, and policy adjustments. The right side is the normal service network handling legitimate voice and video dispatch services.

[0108] Example 2

[0109] Reference Figure 6 This is the second embodiment of the present application, which provides a SIP communication-based scheduling and management system.

[0110] The system includes: a signaling acquisition and parsing module, a feature normalization mapping module, a clustering threshold generation module, a real-time detection and processing module, and a deep analysis and feedback module.

[0111] The signaling acquisition and parsing module acquires historical SIP signaling messages, parses the message header fields, and extracts the source address access frequency, registration request density, and signaling status code distribution characteristics of each source address to form a time-series feature sequence of each source address.

[0112] The feature normalization mapping module normalizes the temporal feature sequences of each source address, extracts the statistical fluctuation of the observations in each dimension of the temporal feature sequence as behavioral stability features, and combines the normalized aggregate features with the normalized behavioral stability features to map them into discrete data points in a multi-dimensional feature space.

[0113] The clustering threshold generation module uses a density-based spatial clustering algorithm to perform cluster analysis on discrete data points, extract normal business clusters, calculate the weights of each dimension, and generate a two-level interception threshold by combining boundary features.

[0114] The real-time detection and handling module collects current SIP signaling packets, statistically analyzes the timing characteristics of the current source address and calculates the weighted feature spatial distance. Based on the degree of distance deviation, it distinguishes between medium-risk and high-risk anomaly levels, and performs parallel bypass mirror forwarding and signaling blocking list distribution for high-risk anomaly source addresses.

[0115] The deep analysis feedback module performs protocol parsing on the mirrored packets in the isolation sandbox, identifies attack types and collaborative attack relationships by combining cross-source address association analysis, generates and pushes structured security alarm events, and feeds back the alarm results to update the boundaries of normal business clusters.

[0116] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the displayed or discussed mutual couplings or direct couplings or communication connections may be through some communication interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0117] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments under the guidance of this application without departing from the spirit and scope of protection of the claims. All of these variations are within the protection scope of this application.

[0118] It should be noted that the collection, storage, and use of all personal information involved in the technical solution of this invention must be carried out only after obtaining the explicit authorization and separate consent of the information subject. The processing of personal information-related data strictly complies with the requirements of currently effective national laws, regulations, and relevant standards and specifications. The collected personal information is limited to use within the specific purpose necessary to achieve the technical solution of this invention, and no processing beyond that purpose is performed. Necessary technical and management measures are taken to ensure the security of personal information.

Claims

1. A SIP-based scheduling and management method, characterized in that, include: Obtain historical SIP signaling messages, parse the message header fields, extract the source address access frequency, registration request density and signaling status code distribution characteristics of each source address, and form a time-series feature sequence of each source address. The time-series feature sequences of each source address are normalized, and the statistical fluctuation of the observation values ​​of each dimension of the time-series feature sequence is extracted as the behavioral stability feature. The normalized aggregated feature and the normalized behavioral stability feature are combined and mapped to discrete data points in a multi-dimensional feature space. A density-based spatial clustering algorithm is used to perform cluster analysis on discrete data points, extract normal business clusters, calculate the weights of each dimension, and generate a two-level interception threshold by combining boundary features. Collect current SIP signaling packets, statistically analyze the timing characteristics of the current source address and calculate the weighted feature spatial distance, distinguish medium-risk and high-risk anomaly levels based on the degree of distance deviation, and perform parallel bypass mirror forwarding and signaling blocking list distribution for high-risk anomaly source addresses; In the isolated sandbox, the mirrored packets are parsed according to the protocol. By combining cross-source address association analysis, the attack types and collaborative attack relationships are identified, structured security alert events are generated and pushed, and the alert results are fed back to update the boundaries of normal business clusters.

2. The SIP communication-based scheduling and management method according to claim 1, characterized in that, The process of obtaining historical SIP signaling messages and parsing message header fields includes: configuring a port mirroring interface on the signaling transmission link of the command and dispatch core switching equipment, and mirroring and copying the SIP signaling messages to the signaling acquisition server. The signaling acquisition server performs deduplication filtering based on the sequence number and acknowledgment number fields in the transport layer protocol header, timestamps the reception time of each message using a synchronized standard clock source, and segments and archives the messages according to a preset time window. The preset time window is evenly divided into several consecutive sub-time segments that are connected end to end and do not overlap. The source address information is obtained by parsing the From field of the SIP protocol header of each message, and the request method type information is obtained by parsing the CSeq field. After grouping by source address, various features are statistically analyzed in each sub-time segment.

3. The SIP communication-based scheduling and management method according to claim 1, characterized in that, The normalization process for the temporal feature sequences of each source address includes: for two types of scalar features, namely source address access frequency and registration request density, statistically analyzing the numerical distribution of all sub-time segment observations of all source address samples, calculating the preset lower quantile and preset upper quantile to determine the endpoints of the truncation interval, and performing boundary replacement on extreme observations that exceed the truncation interval before linear scaling and normalization to the zero-to-one interval. For the six-dimensional probability distribution vector of the signaling status code distribution characteristics, linear scaling is performed on each component with the minimum and maximum values ​​in all source address samples as the interval endpoints. When the minimum and maximum values ​​of a component are equal, the normalization result of the corresponding component is uniformly set to zero.

4. The SIP communication-based scheduling and management method according to claim 1, characterized in that, The statistical fluctuation of the observed values ​​of each dimension of the extracted time-series feature sequence is used as the behavioral stability feature. The normalized aggregate feature and the normalized behavioral stability feature are combined and mapped to discrete data points in the multi-dimensional feature space. This includes: calculating the standard deviation of the corresponding feature dimension on the normalized observed values ​​of all sub-time segments for each component of the normalized source address access frequency, registration request density and signaling status code distribution features as the behavioral stability index. Using the component-wise extreme value linear scaling method, the minimum and maximum values ​​of the behavioral stability index corresponding to each source address in all source address samples are taken as the interval endpoints. The behavioral stability index is then subjected to linear scaling normalization and mapped to the zero-to-one interval to obtain the normalized behavioral stability index. The arithmetic mean of the observations of each sub-time segment after normalization is used as the aggregation feature, and combined with the stability index of normalization behavior according to the fixed dimension arrangement rule to construct an enhanced multidimensional feature vector. The enhanced multidimensional feature vector corresponding to each source address is used as a discrete data point in the multidimensional feature space.

5. The SIP communication-based scheduling and management method according to claim 1, characterized in that, The method of using a density-based spatial clustering algorithm to perform cluster analysis on discrete data points and extract normal business clusters includes: setting a preset neighborhood search radius parameter and a minimum neighborhood sample number parameter; traversing each discrete data point in the sample point set consisting of all discrete data points; marking data points with a neighborhood sample number not less than the minimum neighborhood sample number parameter as core points; marking data points that fall within the neighborhood of core points but are not core points themselves as boundary points; and marking data points that are neither core points nor within the neighborhood of any core point as noise points. Iterative merging of clusters is performed based on the density reachability relationship between core points, and the cluster with the most data points is selected from the resulting clusters and labeled as normal business clusters. When there are multiple clusters containing the same number of data points, and each cluster has the largest number of data points, the cluster with the highest average density of internal data points is selected and labeled as the normal business cluster.

6. The SIP communication-based scheduling and management method according to claim 1, characterized in that, The calculation of the weights for each dimension includes: calculating the cluster center coordinates of the normal business cluster as the arithmetic mean of the coordinate vectors of all discrete data points within the normal business cluster; Calculate the variance of all discrete data points within the normal business cluster in each feature dimension. The adaptive weight of each feature dimension is determined based on the inverse relationship of the variance of the corresponding dimension.

7. The SIP communication-based scheduling and management method according to claim 1, characterized in that, The method of generating a two-level interception threshold by combining boundary features includes: calculating the feature space distance between each discrete data point in the normal service cluster and the center of the normal service cluster using weighted Euclidean distance, arranging all distance values ​​in ascending order and extracting the distance value at the preset high quantile position as the boundary feature value; A first-level safety margin coefficient is introduced to expand the boundary feature value to generate a first-level interception threshold. Based on the first-level interception threshold, a high-risk judgment multiplier is introduced to generate a second-level interception threshold. The dual-level interception threshold adopts a periodic dynamic update mechanism, which re-executes feature extraction, cluster analysis and threshold calculation according to a preset period based on a new time window to track the evolution trend of normal business behavior patterns.

8. The SIP communication-based scheduling and management method according to claim 1, characterized in that, The step of statistically analyzing the current source address time-series characteristics and calculating the weighted feature spatial distance includes: continuously capturing SIP signaling messages from the real-time access command and dispatch core switching equipment, and recording the current source address identifier and the corresponding message timestamp and method type into the real-time signaling log cache using a first-in-first-out ring storage structure; The current sliding time window is determined with the current time as the endpoint and the preset sliding window duration as the span. Within the current sliding time window, the temporal characteristics of each active source address are statistically analyzed according to continuous sub-time segments. After normalization processing using the normalization parameters determined in the historical modeling stage, the data is mapped to real-time data points. The weighted feature space distance from the real-time data points to the normal business cluster center is calculated based on the adaptive weight vector.

9. The SIP communication-based scheduling and management method according to claim 1, characterized in that, The method of distinguishing between medium-risk and high-risk anomalies based on the degree of distance deviation includes: when the real-time weighted feature spatial distance does not exceed the first-level interception threshold, the current source address is determined to be normal and no action is triggered. When the real-time weighted feature spatial distance exceeds the first-level interception threshold but does not exceed the second-level interception threshold, it is determined to be a medium-risk abnormal source address. The real-time feature statistical update cycle is shortened and signaling behavior is continuously observed. When the real-time weighted feature spatial distance exceeds the second-level interception threshold, it is determined to be a high-risk abnormal source address. Two parallel processing operations are initiated: bypass mirror forwarding and signaling blocking list issuance.

10. The SIP communication-based scheduling and management method according to claim 1, characterized in that, The parallel execution of bypass mirroring forwarding and signaling blocking list distribution for high-risk abnormal source addresses includes: configuring a dedicated bypass mirroring forwarding policy for high-risk abnormal source addresses at the session boundary controller, and copying and forwarding all signaling messages sent by the high-risk abnormal source addresses to an isolation sandbox that is logically isolated from the production network in real time. Send a signaling blocking access control list carrying high-risk abnormal source address identification information to the session boundary controller, and perform rejection processing on subsequent signaling access requests from high-risk abnormal source addresses, thus moving the interception point of abnormal signaling to the network boundary.

11. The SIP communication-based scheduling and management method according to claim 1, characterized in that, The protocol parsing of the mirrored message in the isolated sandbox includes: performing layer-by-layer protocol stack decoding on the mirrored message, which sequentially encapsulates the transport layer, SIP message layer, and session description protocol, and extracting three key information types from the protocol field tree: the message body content of the SIP message layer, the session description parameters, and the authentication credential field. Based on a pre-defined attack feature rule base, feature pattern matching is performed on key information to identify different attack types.

12. The SIP communication-based scheduling and management method according to claim 1, characterized in that, The method of identifying attack types and cooperative attack relationships by combining cross-source address association analysis includes: evaluating the degree of association between high-risk abnormal source addresses from three dimensions: time, attack target and attack type; when multiple high-risk abnormal source addresses simultaneously meet the cooperative attack judgment conditions in at least two of the three evaluation dimensions, they are marked as a cooperative attack group. The step of feeding back alarm results to update the boundaries of normal service clusters includes: maintaining a list of confirmed attack source addresses, removing data points corresponding to confirmed attack source addresses from the sample point set during periodic dynamic updates, re-performing cluster analysis and threshold calculation, and updating the list of confirmed attack source addresses.

13. A SIP-based communication scheduling and management system, used to implement the SIP-based communication scheduling and management method according to any one of claims 1 to 12, characterized in that, include: The module includes a signaling acquisition and parsing module, a feature normalization mapping module, a clustering threshold generation module, a real-time detection and processing module, and a deep analysis and feedback module. The signaling acquisition and parsing module acquires historical SIP signaling messages, parses the message header fields, and extracts the source address access frequency, registration request density, and signaling status code distribution characteristics of each source address to form a time-series feature sequence of each source address. The feature normalization mapping module normalizes the temporal feature sequences of each source address, extracts the statistical fluctuation of the observation values ​​of each dimension of the temporal feature sequence as the behavioral stability feature, and combines the normalized aggregated feature with the normalized behavioral stability feature to map it into discrete data points in a multi-dimensional feature space. The clustering threshold generation module uses a density-based spatial clustering algorithm to perform cluster analysis on discrete data points, extract normal business clusters, calculate the weights of each dimension, and generate a two-level interception threshold by combining boundary features. The real-time detection and processing module collects current SIP signaling packets, statistically analyzes the timing characteristics of the current source address and calculates the weighted feature spatial distance, distinguishes between medium-risk and high-risk anomaly levels based on the degree of distance deviation, and performs parallel bypass mirror forwarding and signaling blocking list distribution for high-risk anomaly source addresses. The deep analysis feedback module performs protocol parsing on the mirrored packets in the isolation sandbox, identifies attack types and collaborative attack relationships by combining cross-source address association analysis, generates and pushes structured security alarm events, and feeds back the alarm results to update the boundaries of normal business clusters.

Images