CT-ISG: Collaborative Research: Intrusion Detection Techniques for Voice over IP

Sushil Jadodia乔治梅森大学0627493小组：P060969合作研究：IP语音的入侵检测技术近年来IP语音（VoIP）正在经历一个惊人的增长，作为一个时间敏感的服务，VoIP甚至比常规的互联网服务更容易受到恶意攻击。 此外，VoIP使用多种协议进行呼叫控制和数据传输，这使得它容易受到不同协议层的各种攻击。 由于跨协议交互的差异以及不同握手影响分布式服务元素并因此影响VoIP的最终用户服务质量（QoS）的方式，用于数据网络的已知安全解决方案不能保护VoIP应用。 本项目旨在开发一系列适用于VoIP的语音检测技术，并通过实验验证其商业可行性。总体目标是准确及时地检测已知的未知攻击，而不会在呼叫建立时间上产生明显的延迟，研究计划包括两个主要部分：基于协议状态机（PSM）的检测已知攻击的机制和基于Hellinger距离（HD）的检测未知攻击的机制。 协议状态机之间的通信的结合特别适合于VoIP中的入侵检测，因为呼叫控制和媒体传输协议通过在整个建立的会话中交换关键事件的同步消息来实现。 HD检测方案的核心是利用Hellinger距离来度量网络协议行为偏离正常网络协议行为的程度。为了使检测机制对站点和流量模式不敏感，使用了动态自调节阈值，从而使检测机制鲁棒、适用范围广且易于部署。该项目的研究成果将通过出版物、网页和向产业转让技术等方式广泛传播。

Sushil JadodiaGeorge Mason University0627493Panel: P060969Collaborative Research: Intrusion Detection Techniques for Voice Over IPRecently Voice over IP (VoIP) is experiencing a phenomenal growth.Being a time sensitive service, VoIP is even more susceptible tomalicious attacks than regular Internet services. Moreover, VoIP usesmultiple protocols for call control and data delivery, making itvulnerable to various attacks at different protocol layers. Thealready-known security solutions for data networks fall short ofdefending VoIP applications because of the differences of cross protocolinteractions and the way in which the different handshakes effect thedistributed service elements and consequently the end user quality ofservice (QoS) of VoIP. This project seeks to develop a series ofintrusion detection techniques suitable for VoIP and experimentallyverify their commercial viability. Overall objective is to detect knownand unknown attacks in an accurate and timely manner, without incurringa noticeable delay in call setup times.The research plan consists of two major components:Protocol-state-machine (PSM) based mechanism for detecting knownattacks, and Hellinger-distance based (HD) mechanism for detectingunknown attacks. The incorporation of the communication betweenprotocol state machines is particularly suited for intrusion detectionin VoIP, because call control and media delivery protocols aresynchronized by exchanging synchronization messages for critical eventsthroughout the established sessions. The core of HD detection scheme isbased on using the Hellinger distance to measure the deviation fromnormal network protocol behaviors. To have the detection mechanisminsensitive to site and traffic pattern, a dynamic self-regulatingthreshold is used, thus making the detection mechanism robust, widelyapplicable, and easier to deploy. Research results of the project willbe broadly disseminated through publication, web pages, and technologytransfer to industry.