提出了一种IP多媒体子系统(INS)网络中畸形会话初始协议(SIP)信令的快速检测方法.从攻击者的角度出发,通过统计畸形元素在SIP字段和畸形类型上的分布,分析攻击者构造畸形SIP信令的策略,优先对高威胁的SIP字段和畸形类型进行检测,从而在保证检测有效性的同时减少了检测时延.实验结果表明,该方法适用于IMS网络.
A heuristic method for detecting malformed session initiation protocol (SIP) signaling in IP multimedia subsystem (IMS) is presented. The distribution of malformed elements among SIP fields as well as different malformation types is studied to analyze strategies taken by the attacker. High-risk SIP fields and high-threat malformation types are checked with higher priority. Therefore the method will significantly shorten the checking delay while ensuring the credibility of the result. Examination verifies the effectiveness of this method in IMS.