CT-ISG: Collaborative Research: Intrusion Detection Techniques for Voice over IP

王海宁威廉玛丽学院合作研究：基于IP的入侵检测技术目前IP语音（VoIP）正经历着惊人的增长。作为一项时间敏感的服务，VoIP比普通的互联网服务更容易受到恶意攻击。此外，VoIP使用多种协议进行呼叫控制和数据传输，使其容易受到不同协议层的各种攻击。由于跨协议交互的差异以及不同握手影响分布式服务元素的方式，从而影响VoIP的最终用户服务质量（QoS），因此已知的数据网络安全解决方案无法防御VoIP应用程序。该项目旨在开发一系列适合VoIP的入侵检测技术，并通过实验验证其商业可行性。总体目标是以准确和及时的方式检测已知和未知攻击，而不会导致呼叫设置时间的明显延迟。该研究方案主要包括两个部分：基于协议状态机（PSM）的已知攻击检测机制和基于海林格距离（HD）的未知攻击检测机制。协议状态机之间通信的结合特别适合于VoIP中的入侵检测，因为呼叫控制和媒体交付协议通过在整个建立的会话中交换关键事件的同步消息来同步。HD检测方案的核心是利用海灵格距离来测量与正常网络协议行为的偏差。为了使检测机制对站点和流量模式不敏感，使用了动态自调节阈值，从而使检测机制具有鲁棒性、广泛适用性和易于部署的特点。该项目的研究成果将通过出版物、网页和技术转让等方式广泛传播。

Haining WangCollege of William and Mary0627340Panel: P060969Collaborative Research: Intrusion Detection Techniques for Voice Over IPRecently Voice over IP (VoIP) is experiencing a phenomenal growth.Being a time sensitive service, VoIP is even more susceptible tomalicious attacks than regular Internet services. Moreover, VoIP usesmultiple protocols for call control and data delivery, making itvulnerable to various attacks at different protocol layers. Thealready-known security solutions for data networks fall short ofdefending VoIP applications because of the differences of cross protocolinteractions and the way in which the different handshakes effect thedistributed service elements and consequently the end user quality ofservice (QoS) of VoIP. This project seeks to develop a series ofintrusion detection techniques suitable for VoIP and experimentallyverify their commercial viability. Overall objective is to detect knownand unknown attacks in an accurate and timely manner, without incurringa noticeable delay in call setup times.The research plan consists of two major components:Protocol-state-machine (PSM) based mechanism for detecting knownattacks, and Hellinger-distance based (HD) mechanism for detectingunknown attacks. The incorporation of the communication betweenprotocol state machines is particularly suited for intrusion detectionin VoIP, because call control and media delivery protocols aresynchronized by exchanging synchronization messages for critical eventsthroughout the established sessions. The core of HD detection scheme isbased on using the Hellinger distance to measure the deviation fromnormal network protocol behaviors. To have the detection mechanisminsensitive to site and traffic pattern, a dynamic self-regulatingthreshold is used, thus making the detection mechanism robust, widelyapplicable, and easier to deploy. Research results of the project willbe broadly disseminated through publication, web pages, and technologytransfer to industry.