Monitoring SIP traffic using Support Vector Machines - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2008

Monitoring SIP traffic using Support Vector Machines

Résumé

In this paper, we propose a novel online monitoring approach able to distinguish between attacks and normal activity in SIP based Voice over IP environments. We demonstrate the efficiency of the approach even in presence of very limited data sets for the learning phase. The solution builds on the monitoring of a set of 38 features in VoIP flows and on Support Vector Machines for the classification part. We validate our proposal through large offline experiments performed over a mix of real world traces from a large VoIP provider and attacks locally generated on our own testbed. Results show high accuracy to detect SPIT and flooding attacks and promising performance for an online deployment are measured.
Fichier principal
Vignette du fichier
main.pdf (631.74 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

inria-00325290 , version 1 (27-09-2008)

Identifiants

  • HAL Id : inria-00325290 , version 1

Citer

Mohamed Nassar, Radu State, Olivier Festor. Monitoring SIP traffic using Support Vector Machines. 11th International Symposium on Recent advances in intrusion detection - RAID 2008, Sep 2008, Boston, United States. pp.311-330. ⟨inria-00325290⟩
184 Consultations
410 Téléchargements

Partager

Gmail Facebook X LinkedIn More