The Research And Realization Of SIP Flooding Detection Method In IMS Network

IMS is one main part of core network in 3G system. It makes an end-to-end conversation based on session initial protocol (SIP), and gets the QoS it requires. IMS not only solves the problem that can not be solved by Softswitch technology, but also becomes the foundation to converge mobile and fixed line network. As a platform to provide multimedia data service, IMS is an important step to make Communications Network become an IP network. In common Communications Network, security problems are not so much because the network is not completely opened. But IMS will bring threats to today's Communications network. As one of the main threats in internet, Flooding attack will be a significant threat in IMS network.State Key Laboratory of Networking and Switching Technology of Beijing University of Posts & Telecommunications (BUPT) is responsible for the State 863 Project "Safety Evaluation Technology and Tools In Next Generation Telecommunication Network".This paper is based on one part named "Threat Analyse" in this project.The paper first introduces the research background, the architecture and security of IMS, and the intrusion detection technology. The paper then concludes and classifies the possible attack in IMS, and analyzes the principle and harm of every attack. Then a method is presented, which detects SIP message flooding attack in IMS. The method is called Cumulative Sum Algorithm and is commonly used in Internet to detect TCP SYN flooding attack. By doing some modification to this algorithom the method can be correctly used in detection of SIP message flooding attack in IMS. At last the paper introduced the design of threat detection system in this state 863 project, and gived the architecture, code and simulation of SIP message flooding attack detection module, which provided a foundation for the realization of Cumulative Sum Algorithm.