Hunting SIP Authentication Attacks Efficiently - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2017

Hunting SIP Authentication Attacks Efficiently

Tomáš Jansky
  • Fonction : Auteur
  • PersonId : 1032632
Tomáš Čejka
  • Fonction : Auteur
  • PersonId : 995399
Václav Bartoš
  • Fonction : Auteur
  • PersonId : 994070

Résumé

Extended flow records with application layer (L7) information allow for detection of various types of malicious traffic. Voice over IP (VoIP) is an example of technology that works on L7 and many attacks against it cannot be reliably detected using just basic flow information. Session Initiation Protocol (SIP), which is commonly used for VoIP signalling, is a frequent target of many types of attacks. This paper proposes and evaluates a novel algorithm for near real time detection of username scanning and password guessing attacks on SIP servers. The detection is based on analysis of L7 extended flow records.
Fichier principal
Vignette du fichier
452969_1_En_9_Chapter.pdf (240.23 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01806064 , version 1 (01-06-2018)

Licence

Paternité

Identifiants

Citer

Tomáš Jansky, Tomáš Čejka, Václav Bartoš. Hunting SIP Authentication Attacks Efficiently. 11th IFIP International Conference on Autonomous Infrastructure, Management and Security (AIMS), Jul 2017, Zurich, Switzerland. pp.125-130, ⟨10.1007/978-3-319-60774-0_9⟩. ⟨hal-01806064⟩
49 Consultations
130 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More