CT-ISG: Collaborative Research: Intrusion Detection Techniques for Voice over IP

海宁王威廉和玛丽亚学院小组：P060969合作研究：IP语音的入侵检测技术最近IP语音(VoIP)正在经历惊人的增长。VoIP作为一种时间敏感型服务，比常规的互联网服务更容易受到恶意攻击。此外，VoIP使用多种协议来进行呼叫控制和数据传输，这使得它在不同的协议层上容易受到各种攻击。已知的数据网络安全解决方案由于跨协议交互的差异以及不同握手对分布式服务元素的影响从而影响VoIP的最终用户服务质量(Qos)，因此不能防御VoIP应用。本项目旨在开发一系列适用于VoIP的挤出检测技术，并通过实验验证其商业可行性。总体目标是在不引起呼叫建立时间明显延迟的情况下准确、及时地检测已知和未知攻击，研究计划由两个主要部分组成：基于协议状态机(PSM)的已知攻击检测机制和基于Hellinger距离(HD)的未知攻击检测机制。协议状态机之间的通信的结合特别适合于VoIP中的入侵检测，因为呼叫控制和媒体递送协议通过在整个建立的会话中交换关键事件的同步消息来同步。HD检测方案的核心是使用Hellinger距离来度量对正常网络协议行为的偏离。为了使检测机制对站点和流量模式敏感，采用动态自调整门限，使检测机制具有较强的健壮性、广泛的适用性和易于部署的特点。该项目的研究成果将通过出版物、网页和向行业转让技术等方式广泛传播。

Haining WangCollege of William and Mary0627340Panel: P060969Collaborative Research: Intrusion Detection Techniques for Voice Over IPRecently Voice over IP (VoIP) is experiencing a phenomenal growth.Being a time sensitive service, VoIP is even more susceptible tomalicious attacks than regular Internet services. Moreover, VoIP usesmultiple protocols for call control and data delivery, making itvulnerable to various attacks at different protocol layers. Thealready-known security solutions for data networks fall short ofdefending VoIP applications because of the differences of cross protocolinteractions and the way in which the different handshakes effect thedistributed service elements and consequently the end user quality ofservice (QoS) of VoIP. This project seeks to develop a series ofintrusion detection techniques suitable for VoIP and experimentallyverify their commercial viability. Overall objective is to detect knownand unknown attacks in an accurate and timely manner, without incurringa noticeable delay in call setup times.The research plan consists of two major components:Protocol-state-machine (PSM) based mechanism for detecting knownattacks, and Hellinger-distance based (HD) mechanism for detectingunknown attacks. The incorporation of the communication betweenprotocol state machines is particularly suited for intrusion detectionin VoIP, because call control and media delivery protocols aresynchronized by exchanging synchronization messages for critical eventsthroughout the established sessions. The core of HD detection scheme isbased on using the Hellinger distance to measure the deviation fromnormal network protocol behaviors. To have the detection mechanisminsensitive to site and traffic pattern, a dynamic self-regulatingthreshold is used, thus making the detection mechanism robust, widelyapplicable, and easier to deploy. Research results of the project willbe broadly disseminated through publication, web pages, and technologytransfer to industry.