Research And Implementaion Of Malformed SIP Message Detection Subsystem Based On Feature For SBC

SIP is a multimedia communication protocol developed by the IETF.Because of its good semantic,simple structure and good extensibility,SIP has been widely applied to NGN and IMS networks.While SIP is a text-based protocol.When SIP messages are transmitted in the network,they can be easily imitated or tampered,and then be constructed malformed SIP messages.Malformed SIP messages will affect networks,even lead to SIP entity crash.SBC is one of the equipment which can be deployed in the boundary of network and be responsible for security defense.But there are some problems at present,such like SBC can not detect malformed SIP messages comprehensively and correctly.Therefore,the study of how to improve accuracy and how to make detection speed higher is very meaningful.In recent years,the research on malformed SIP messages detection issues mainly based on regular expression or rule detection.However,the method based on regular expression can only detect syntax malformed SIP messages,and its speed of detection is very slow.The method based on rule can only detect known SIP messages.Hence,this paper proposes a two layer detection method based on SIP feature.The first layer is syntax detection layer,the second layer is tri-training model detection layer.First,the author has accumulated a lots of syntax features and concluded a new malformed SIP messages classification method by analyzing related SIP protocals and known malformed SIP messages.Then,this paper proposes a two layer detection method based on SIP features.The first layer is syntax detection layer,this layer divide SIP headers into six classes.Each class has different structure and uses different way to detect.And every specific header not only belongs to one header class,but also will realize its own detected function.This layer can detect all of the syntax malformed SIP messages with high speed.The second layer is tri-training model detection layer.This layer uses N-Gram technology to map SIP messages to high-dimensional feature space.Then it will calculate the information gain of every substring and choice model feature.After tri-training model been trained,it can detects some malformed SIP messages which syntax is correct.Next,this paper describes the design and implementation of the detection subsystem from overall structure and every sub-module in detail.This subsystem is based on the above-mentioned method.Last,this paper deploys and tests the subsystem,which ensures the validity and practicability.