CT-ISG: Collaborative Research: Intrusion Detection Techniques for Voice over IP

CT-ISG：协作研究：IP 语音入侵检测技术

• 批准号: 0627340
• 负责人: Haining Wang
• 金额: --
• 依托单位: College of William and Mary
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2006
• 资助国家: 美国
• 起止时间: 2006-10-01 至 2009-09-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0627340&HistoricalAwards=false
• 关键词: CT; ISG; Collaborative; Research; Intrusion

Haining WangCollege of William and Mary0627340Panel: P060969Collaborative Research: Intrusion Detection Techniques for Voice Over IPRecently Voice over IP (VoIP) is experiencing a phenomenal growth.Being a time sensitive service, VoIP is even more susceptible tomalicious attacks than regular Internet services. Moreover, VoIP usesmultiple protocols for call control and data delivery, making itvulnerable to various attacks at different protocol layers. Thealready-known security solutions for data networks fall short ofdefending VoIP applications because of the differences of cross protocolinteractions and the way in which the different handshakes effect thedistributed service elements and consequently the end user quality ofservice (QoS) of VoIP. This project seeks to develop a series ofintrusion detection techniques suitable for VoIP and experimentallyverify their commercial viability. Overall objective is to detect knownand unknown attacks in an accurate and timely manner, without incurringa noticeable delay in call setup times.The research plan consists of two major components:Protocol-state-machine (PSM) based mechanism for detecting knownattacks, and Hellinger-distance based (HD) mechanism for detectingunknown attacks. The incorporation of the communication betweenprotocol state machines is particularly suited for intrusion detectionin VoIP, because call control and media delivery protocols aresynchronized by exchanging synchronization messages for critical eventsthroughout the established sessions. The core of HD detection scheme isbased on using the Hellinger distance to measure the deviation fromnormal network protocol behaviors. To have the detection mechanisminsensitive to site and traffic pattern, a dynamic self-regulatingthreshold is used, thus making the detection mechanism robust, widelyapplicable, and easier to deploy. Research results of the project willbe broadly disseminated through publication, web pages, and technologytransfer to industry.

William和Mary0627340Panel的Haining Wangcollege：P060969Collaborative Research：in Interife of IP（VoIP）的侵入性检测技术正在体验出惊人的增长。与常规的互联网相比，VoIP更加敏感的服务更加敏感的服务。 此外，VoIP使用变形协议进行呼叫控制和数据传输，从而使各种协议层的各种攻击都可以进行。 由于跨协议互动的差异以及不同的握手效应的服务元素以及VOIP的最终用户质量的服务质量（QOS），因此，数据网络的新著名安全解决方案缺乏防止VoIP应用程序。 该项目旨在开发一系列适合VoIP的入学检测技术，并实验性地证明其商业生存能力。总体目的是以准确，及时的方式检测已知和未知攻击，而不会在呼叫设置时间中引起明显的延迟。研究计划由两个主要组成部分组成：基于协议 - 状态机器（PSM）检测已知攻击的机制，以及用于检测Hellinger-Pance（HD）检测攻击的机制（HD）机制。 协议状态机器之间的通信结合特别适合于Intrusion in VoIP中，因为呼叫控制和媒体传递协议通过将同步消息交换为既定会话的关键事件而通过交换同步消息来实现。 HD检测方案的核心基于使用Hellinger距离来测量非正态网络协议行为的偏差。为了对站点和流量模式具有检测机构敏感，使用了动态的自我调节阈值，从而使检测机制可靠，可广泛且易于部署。该项目的研究结果将通过出版，网页和技术转移到行业中广泛传播。