Studying On Intrusion Detection Based On SIP For IMS

IMS (IP Multimedia Subsystem) is becoming the network convergence architecture for the NGN (Next Generation Network). But the network convergence and connection with different networks brings some new security problems. Although there are lots of standards and research work on the security problems for IMS, there are still many security problems in IMS. Much more security mechanisms should be researched and developed to protect the network. So, it is very important to study the intrusion detection technology for IMS to enhance the capability of resisting attacks to IMS. But the current technology of intrusion detection which is base on the rule matching can not work well in IMS because of the difference between IMS and Internet. It is necessary to research a new intrusion detedtion technology for IMS.This paper analyzed the characteristic of IMS and proposed a new method of attack detection which based on abnormal states transform of protocol aimed at multi-packet joint attack and cross protocol joint attack of SIP. Cross protocol detection will lead the development of intrusion detection technique.Firstly, this paper introduced the development process of intrusion technology, and analyzed the characteristic of SIP attack behavior. Secondly, the paper illustrated the theory principle of attack detection based on SIP. Last, this paper showed the detailed design of the intrusion detection system and the implement of the core detection algorithm.