论文部分内容阅读
提出一种支持检测规则动态更新的畸形会话发起协议(SIP)消息检测模型,采用正向规则和反向规则结合的方式,以有效应对未知类型的畸形攻击.采用Map-Reduce模型实现检测规则,检测过程分为常规检测和特殊检测,常规检测阶段检测消息的基本格式,特殊检测阶段将SIP消息分割后并行检测语法规则.实验结果表明,提出的检测模型能准确高效地检测出SIP消息中的畸形特征.
This paper proposes a malformed Session Initiation Protocol (SIP) message detection model that supports the dynamic update of detection rules and adopts a combination of forward and reverse rules to effectively deal with unknown types of malformed attacks.Using Map-Reduce model to implement detection rules, The detection process is divided into the routine detection and the special detection, the basic format of the routine detection message during the regular detection phase, and the parallel detection syntax rule after the SIP message segmentation in the special detection phase.The experimental results show that the proposed detection model can accurately and efficiently detect SIP messages Deformity characteristics.