Intrusion detection in IMS: Experiences with a Hellinger distance-based flooding detector

1st International Conference on Evolving Internet, INTERNET 2009

Volumn , Issue , 2009, Pages 65-70

  Hecht, Christoph ^a   Reichl, Peter ^a,b   Berger, Andreas ^b   Jung, Oliver ^b   Gojmerac, Ivan ^b  

^a UNIVERSITY OF APPLIED SCIENCES TECHNIKUM WIEN   (Austria)

^b TELECOMMUNICATIONS RESEARCH CENTER VIENNA FTW   (Austria)

Author keywords

Hellinger distance; IMS bench; Intrusion detection system; IP multimedia subsystem; SIPp

Indexed keywords

DETECTION RATES; EMPIRICAL PROBABILITIES; HELLINGER DISTANCE; INTRUSION DETECTION APPROACHES; INTRUSION DETECTION SYSTEMS; IP MULTIMEDIA SUBSYSTEMS; PRACTICAL EXPERIENCE; SECURITY THREATS; TRAFFIC GENERATION;

COMPUTER CRIME; DETECTORS; INSULATING MATERIALS; INTERNET; INTERNET PROTOCOLS; MULTIMEDIA SYSTEMS; PROBABILITY DISTRIBUTIONS; TELECOMMUNICATION EQUIPMENT;

INTRUSION DETECTION;

EID: 71249115571     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/INTERNET.2009.17     Document Type: Conference Paper

References (21)

1. 3GPP TS23.228: IP Multimedia Subsystem (IMS); Stage 2; Release 8; http://www.3gpp.org/ftp/Specs/html-info/23228.htm, Dec. 2008.
2. S. Axelsson: Intrusion Detection Systems: A Survey and Taxonomy. Technical Report No 99-15, Dept. of Computer Engineering, Chalmers University of Technology, Sweden, March 2000.
3. G. Camarillo, M. Garcia-Martin: The 3G IP Multimedia Subsystem (IMS). Wiley, 2008.
4. J. Cao, W. Cleveland, D. Lin, D. Sun: Internet Traffic Tends To Poisson and Independent as the Load Increases, in: C. Holmes, D. Denison, M. Hansen, B. Yu, and B. Mallick (eds.): Nonlinear Estimation and Classification , Springer, New York, 2002.
5. M. Garuba, C. Liu and D. Fraites: Intrusion Techniques: Comparative Study of Network Intrusion Detection Systems. Proc. 5th Intern. Conf. on Information Technology: New Generations, pp. 592-598, 2008.
6. C. Gates, C. Taylor: Challenging the anomaly detection paradigm: a provocative discussion. Proc. Workshop on New Security Paradigms, pp. 21-29, 2007.
7. E. Hellinger: Die Orthogonalinvarianten quadratischer Formen von unendlich vielen Veränderlichen. PhD thesis, Göttingen, 1907.
8. National Institute of Standards and Technology (NIST): An Overview of issues in testing intrusion detection systems. Gaithersburg: NIST; URL: http://csrc.nist.gov/publications/nistir/nistir-7007.pdf, 2003.
9. National Institute of Standards and Technology: Guide to Intrusion Detection and Prevention Systems (IDPS). Gaithersburg: NIST; Spec. Pub. 800-94; http://csrc.nist.gov/publications/PubsSPs.html, 2007.
10. st IPTCOMM'07, 2007.
11. A. Patcha, J. Park: An overview of anomaly detection techniques: existing solutions and latest technological trends. Computer Networks, 51(12), pp. 3448-3470, Aug 2007.
12. J. Peterson: A Privacy Mechanism for the Session Initiation Protocol (SIP). IETF RFC 3323, Nov. 2002.
13. T. Ptacek, T. Newsham: Insertion, Evation and Denial of Service: Eluding Network Intrusion Detection; Tech. Report, 1998.
14. P. Reichl, S. Bessler, J. Fabini, et al.: Practical Experiences with an IMS-Aware Location Service Enabler on Top of an Experimental Open Source IMS Core Implementation Journal of Mobile Multimedia, vol. 2 (2006) no. 3.
15. J. Rosenberg, H. Schulzrinne, G. Camarillo, A. Johnston, J. Peterson, J. Sparks, M. Handley, E. Schooler: SIP: Session Initiation Protocol. IETF RFC 3263, June 2002.
16. H. Sengar, H. Wang, D. Wijesekera, S. Jajodia: Fast Detection of Denial-of-Service Attacks on IP. Proc. of IEEE IWQoS''06, 2006.
17. SIPp Documentation; Version: October 2008 Available from: http://sipp.sourceforge.net/doc/reference.html; Oct 2008
18. Tcpdump: Pcap man page; Version: November 2003; Available from: http://www.tcpdump.org/pcap3-man.html; March 2009.
19. SiP Vulnerability Scanner User Guide v1.07; Version: 2004; Available from: www.vopsecurity.com ; Feb 2009.
20. Configuration, Architecture, Migration, Performance Analysis and Requirements of 3G IMS. URL: http://www.ftw.at/ftw/research/projects/ ProjekteFolder/N3; Feb 2009
21. Beyond Architectural Convergence: Charging, Security, Applications, Realization and Demonstration of IMS. URL: www.ngnlab.at.; Feb 2009.