SIP Intrusion Detection and Response Architecture for Protecting SIP-based Services

After 3GPP had selected SIP as the signaling protocol for IMS, it is expected that SIP plays an important role in IP multimedia services. But, since SIP-based services are offered over the internet, there are security threats inherited from the internet environment. There are also new security threats because new techniques have been introduced to deliver multimedia traffic over the internet. In this paper, we propose the SIP intrusion detection and response architecture for protecting SIP-based services. The proposed architecture consists of detection of SIP-based attacks, detection of SIP traffic anomaly, and management of SIP-aware security devices. This is helpful to counter newly introduced SIP-based attacks without degradation of multimedia quality. Key-Words: SIP, VoIP, Internet telephony, IMS, Intrusion detection and response, Traffic anomaly detection, Security event correlation