CT-ISG: Collaborative Research: Intrusion Detection Techniques for Voice over IP

Haining Wang威廉玛丽学院0627340小组：P060969合作研究：IP语音入侵检测技术最近IP语音(VoIP)正在经历惊人的增长。作为一种时间敏感的服务，VoIP比常规互联网服务更容易受到恶意攻击。 此外，VoIP 使用多种协议进行呼叫控制和数据传输，使其容易受到不同协议层的各种攻击。 由于跨协议交互的差异以及不同握手影响分布式服务元素以及最终用户 VoIP 服务质量 (QoS) 的方式，已知的数据网络安全解决方案不足以防御 VoIP 应用。 该项目旨在开发一系列适用于 VoIP 的入侵检测技术，并通过实验验证其商业可行性。总体目标是准确及时地检测已知和未知攻击，而不会在呼叫建立时间中造成明显的延迟。该研究计划由两个主要部分组成：用于检测已知攻击的基于协议状态机（PSM）的机制，以及用于检测未知攻击的基于Hellinger距离（HD）的机制。 协议状态机之间通信的结合特别适合 VoIP 中的入侵检测，因为呼叫控制和媒体传送协议是通过在整个已建立的会话中交换关键事件的同步消息来同步的。 HD检测方案的核心是利用Hellinger距离来衡量与正常网络协议行为的偏差。为了使检测机制对站点和流量模式不敏感，使用动态自调节阈值，从而使检测机制稳健、适用性广且易于部署。该项目的研究成果将通过出版物、网页和向行业的技术转让来广泛传播。

Haining WangCollege of William and Mary0627340Panel: P060969Collaborative Research: Intrusion Detection Techniques for Voice Over IPRecently Voice over IP (VoIP) is experiencing a phenomenal growth.Being a time sensitive service, VoIP is even more susceptible tomalicious attacks than regular Internet services. Moreover, VoIP usesmultiple protocols for call control and data delivery, making itvulnerable to various attacks at different protocol layers. Thealready-known security solutions for data networks fall short ofdefending VoIP applications because of the differences of cross protocolinteractions and the way in which the different handshakes effect thedistributed service elements and consequently the end user quality ofservice (QoS) of VoIP. This project seeks to develop a series ofintrusion detection techniques suitable for VoIP and experimentallyverify their commercial viability. Overall objective is to detect knownand unknown attacks in an accurate and timely manner, without incurringa noticeable delay in call setup times.The research plan consists of two major components:Protocol-state-machine (PSM) based mechanism for detecting knownattacks, and Hellinger-distance based (HD) mechanism for detectingunknown attacks. The incorporation of the communication betweenprotocol state machines is particularly suited for intrusion detectionin VoIP, because call control and media delivery protocols aresynchronized by exchanging synchronization messages for critical eventsthroughout the established sessions. The core of HD detection scheme isbased on using the Hellinger distance to measure the deviation fromnormal network protocol behaviors. To have the detection mechanisminsensitive to site and traffic pattern, a dynamic self-regulatingthreshold is used, thus making the detection mechanism robust, widelyapplicable, and easier to deploy. Research results of the project willbe broadly disseminated through publication, web pages, and technologytransfer to industry.