Transaction-pattern-based anomaly detection algorithm for IP multimedia subsystem

IEEE Transactions on Information Forensics and Security

Volumn 6, Issue 1, 2011, Pages 152-161

  Chen, Chi Yuan ^a   Chang, Kai Di ^b   Chao, Han Chieh ^a,b  

^a NATIONAL DONG HWA UNIVERSITY   (Taiwan)

^b NATIONAL ILAN UNIVERSITY   (Taiwan)

Author keywords

Anomaly detection; high order Markov chain; IP multimedia subsystem (IMS); next generation networks; support vector machine (SVM)

Indexed keywords

ANOMALY DETECTION; ANOMALY-DETECTION ALGORITHMS; CORE NETWORKS; DETECTION ALGORITHM; FEATURE SELECTION; HIGH-ORDER; IP ADDRESSS; IP MULTIMEDIA SUBSYSTEMS; IP NETWORKS; MARKOV KERNELS; MULTIMEDIA SUBSYSTEMS; NEXT GENERATION NETWORK; PREDICTION RATE; SECURITY ISSUES; TRANSACTION PATTERNS; USER EQUIPMENTS; VALUE ADDED SERVICE;

ALGORITHMS; FEATURE EXTRACTION; FILTRATION; GEARS; MARKOV PROCESSES; NETWORK ARCHITECTURE; SIGNAL DETECTION; SUPPORT VECTOR MACHINES; TELECOMMUNICATION EQUIPMENT;

INTERNET PROTOCOLS;

EID: 79951844361     PISSN: 15566013     EISSN: None     Source Type: Journal    
DOI: 10.1109/TIFS.2010.2095845     Document Type: Article

References (30)

1. 3GPP, 3rd Generation Partnership Project; Technical Specification Group Services and Systems Aspects; IP Multimedia subsystem (IMS); Stage 2, Technical Specification 3G TS 23.228 Version 5.10.0 (2003-10), 2003 [Online]. Available: http://www.3gpp.org/
2. 3GPP, 3rd Generation Partnership Project; Technical Specification Group Services and Systems Aspects; IP Multimedia subsystem (IMS); Stage 2, Technical Specification 3G TS 23.228 Version 6.10.0 (2005-08), 2005 [Online]. Available
3. J. Rosenberg et al., "SIP: Session initiation protocol," in Proc. IETF, 2002, Paper RFC 3261.
4. C. Y. Chen, T. Y. Wu, Y. M. Huang, and H. H. Chao, "An efficient end-to-end security mechanism for IP multimedia subsystem," Comput. Commun., vol. 31, no. 18, pp. 4259-4268, Dec. 2008.
5. K. D. Chang, C. Y. Chen, J. L. Chen, and H. H. Chao, "Challenges to next generation services in IP multimedia subsystem," J. Inf. Process. Syst., vol. 6, no. 2, pp. 129-146, Jun. 2010.
6. M. Sher, S. Wu, and T. Magedanz, "Security threats and solutions for application server of IP multimedia subsystem (IMS-AS)," in Proc. IEEE/IST Workshop on Monitoring, Attack Detection and Mitigation (Mon AM2006), Tuebingen, Germany, Sep. 28-29, 2006.
7. M. Sher and T. Magedanz, "Protecting IP multimedia subsystem (IMS) service delivery platform from time independent attacks," in Proc. Third Int. Symp. Information Assurance and Security (IAS 2007), 2007, pp. 171-176.
8. Y. Rebahi, M. Sher, and T. Magedanz, "Detecting flooding attacks against IP multimedia subsystem (IMS) networks," in Proc. 7th ACS/IEEE Int. Conf. Computer Systems and Applications (AICCSA 2008), Doha, Qatar, Mar. 31-Apr. 4, 2008, pp. 848-851.
9. I. Tirado, "IP multimedia subsystem (IMS) signaling core security," in Proc. 5th Annu. Conf. Information Security Curriculum Development, Kennesaw, Georgia, 2008.
10. M. T. Hunter, R. J. Clark, and F. S. Park, "Security issues with the IP multimedia subsystem (IMS)," in Proc. 2007 Workshop on Middleware forNext-Generation Converged Networks and Applications, Port Beach, CA, 2007.
11. R. A. Kemmerer and G. Vigna, "Intrusion detection: A brief history and overview," Computer, vol. 35, pp. 27-30, 2002.
12. H. Debar, M. Dacier, and A. Wespi, "A revised taxonomy for intrusiondetection systems," Ann. Telecommun., vol. 55, pp. 361-378, 2000.
13. A. H. Farooqi and A. Munir, "Intrusion detection system for IP multimedia subsystem using K-nearest neighbor classifier," in Proc. IEEE Int. Multitopic Conf. (INMIC 2008), 2008, pp. 423-428.
14. H. Sengar, W. Haining, D. Wijesekera, and S. Jajodia, "Detecting Vo IP floods using the Hellinger distance," IEEE Trans. Parallel Distrib. Syst., vol. 19, no. 6, pp. 794-805, Jun. 2008. (Pubitemid 351712185)
15. C. Hecht, P. Reichl, A. Berger, O. Jung, and I. Gojmerac, "Intrusion detection in IMS: Experiences with a Hellinger distance-based flooding detector," in Proc. First Int. Conf. Evolving Internet (INTERNET'09), 2009, pp. 65-70.
16. D. Pollard, Asymptopia First ed., 2000 [Online].Available: http://www. stat.yale.edu pollard/, to be published
17. C. J. C. Burges, "A tutorial on support vector machines for pattern recognition," Data Mining and Knowledge Discovery, vol. 2, pp. 121-167, Jun. 1, 1998. (Pubitemid 128695475)
18. C. Yin, S. Tian, and S. Mu, "High-order Markov kernels for intrusion detection," Neurocomputers, vol. 71, pp. 3247-3252, 2008.
19. A. Berchtold and A. E. Raftery, "The mixture transition distribution model for high-order Markov chains and non-Gaussian time series," Statist. Sci., vol. 17, pp. 328-356, Aug. 2002.
20. Y. Nong, L. Xiangyang, C. Qiang, S. M. Emran, and X. Mingming, "Probabilistic techniques for intrusion detection based on computer audit data," IEEE Trans. Syst., Man Cybern. A, Syst., Humans, vol. 31, no. 4, pp. 266-274, Jul. 2001. (Pubitemid 33142052)
21. 3GPP, 3rd Generation Partnership Project; Technical Specification Group Core Network; Signaling flows for the IP multimedia call control based on SIP and SDP; Stage 3, Technical Specification 3G TS 24.228 Version 5.5.0 (2003-06), 2003.
22. Open IMS Core Jul. 30, 2009 [Online]. Available: http://www.openimscore. org/
23. UCT IMS Client Jul. 30, 2009 [Online]. Available: http://uctimsclient. berlios.de/
24. IMS/NGN Performance Benchmark Jul. 30, 2009 [Online]. Available: http://sipp.sourceforge.net/ims-bench/
25. Wire Shark Jul. 30, 2009 [Online]. Available: http://www.wireshark. org/
26. TCPDump/Lib PCAP Jul. 30, 2009 [Online]. Available: http://www. tcpdump.org/
27. LIBSVM\A Library for Support Vector Machines Jul. 30, 2009 [Online]. Available: http://www.csie.ntu.edu.tw/~cjlin/libsvm/
28. J. Wiljakka, J. Soininen, J. Sundquist, and T. Sipilä, "IPv6 enabling IMS-based peer-to-peer services in 3GPP and 3GPP2 cellular networks," J. Internet Technol., vol. 5, no. 2, pp. 67-73, Apr. 2004.
29. F. Bari and V. C. M. Leung, "Architectural aspects of automated network selection in heterogeneous wireless systems," Int. J. Ad Hoc Ubiquitous Comput., vol. 4, no. 5, pp. 282-291, 2009.
30. M. T. Alam and Z. D. Wu, "Optimal routing for SIP-based session set up over IMS in mobile environment," Int. J. Internet Protocol Technol., vol. 2, no. 3, pp. 264-276, 2007. (Pubitemid 351522893)