Monitoring SIP traffic using Support Vector Machines

Mohamed Nassar 1, * Radu State 1 Olivier Festor 1
* Auteur correspondant
1 MADYNES - Management of dynamic networks and services
INRIA Lorraine, LORIA - Laboratoire Lorrain de Recherche en Informatique et ses Applications
Abstract : In this paper, we propose a novel online monitoring approach able to distinguish between attacks and normal activity in SIP based Voice over IP environments. We demonstrate the efficiency of the approach even in presence of very limited data sets for the learning phase. The solution builds on the monitoring of a set of 38 features in VoIP flows and on Support Vector Machines for the classification part. We validate our proposal through large offline experiments performed over a mix of real world traces from a large VoIP provider and attacks locally generated on our own testbed. Results show high accuracy to detect SPIT and flooding attacks and promising performance for an online deployment are measured.
Type de document :
Communication dans un congrès
Richard Lippmann, Engin Kirda and Ari Trachtenberg. 11th International Symposium on Recent advances in intrusion detection - RAID 2008, Sep 2008, Boston, United States. Springer, 5230, pp.311-330, 2008, Lecture Notes in Computer Science
Liste complète des métadonnées

Littérature citée [3 références]  Voir  Masquer  Télécharger

https://hal.inria.fr/inria-00325290
Contributeur : Mohamed Nassar <>
Soumis le : samedi 27 septembre 2008 - 17:03:18
Dernière modification le : jeudi 11 janvier 2018 - 06:19:49
Document(s) archivé(s) le : lundi 8 octobre 2012 - 13:36:22

Fichier

main.pdf
Fichiers produits par l'(les) auteur(s)

Identifiants

  • HAL Id : inria-00325290, version 1

Collections

Citation

Mohamed Nassar, Radu State, Olivier Festor. Monitoring SIP traffic using Support Vector Machines. Richard Lippmann, Engin Kirda and Ari Trachtenberg. 11th International Symposium on Recent advances in intrusion detection - RAID 2008, Sep 2008, Boston, United States. Springer, 5230, pp.311-330, 2008, Lecture Notes in Computer Science. 〈inria-00325290〉

Partager

Métriques

Consultations de la notice

294

Téléchargements de fichiers

361