Department of Computer Systems

Conference paper

BARTOŠ Václav. Using Application-Aware Flow Monitoring for SIP Fraud Detection. In: Intelligent Mechanisms for Network Configuration and Security,. Ghent: Springer International Publishing, 2015, pp. 87-99. ISBN 978-3-319-20033-0.
Publication language:english
Original title:Using Application-Aware Flow Monitoring for SIP Fraud Detection
Title (cs):Použití aplikačního flow monitorování pro detekci podvodů přes SIP
Pages:87-99
Proceedings:Intelligent Mechanisms for Network Configuration and Security,
Conference:9th International Conference on Autonomous Infrastructure, Management and Security
Series:LNCS 9122
Place:Ghent, BE
Year:2015
ISBN:978-3-319-20033-0
Publisher:Springer International Publishing
Keywords
flow monitoring, network security, VoIP, SIP, fraud
Annotation
Flow monitoring helps to discover many network security threats targeted to various applications or network protocols. In this paper, we show usage of the flow data for analysis of a Voice over IP (VoIP) traffic and a threat detection. A traditionally used flow record is insufficient for this purpose and therefore it was extended by application-layer information. In particular, we focus on the Session Initiation Protocol (SIP) and the type of a toll-fraud in which an attacker tries to exploit poor configuration of a private branch exchange (PBX). The attacker's motivation is to make unauthorized calls to PSTN numbers that are usually charged at high rates and owned by the attacker. As a result, a successful attack can cause a significant financial loss to the owner of PBX. We propose a method for stream-wise and near real-time analysis of the SIP traffic and detection of the described threat. The method was implemented as a module of the Nemea system and deployed on a backbone network. It was evaluated using simulated as well as real attacks.
BibTeX:
@INPROCEEDINGS{
   author = {V{\'{a}}clav Barto{\v{s}}},
   title = {Using Application-Aware Flow Monitoring for SIP Fraud
	Detection},
   pages = {87--99},
   booktitle = {Intelligent Mechanisms for Network Configuration and
	Security,},
   series = {LNCS 9122},
   year = {2015},
   location = {Ghent, BE},
   publisher = {Springer International Publishing},
   ISBN = {978-3-319-20033-0},
   language = {english},
   url = {http://www.fit.vutbr.cz/research/view_pub.php.en.iso-8859-2?id=10810}
}

Your IPv4 address: 54.90.207.75
Switch to IPv6 connection

DNSSEC [dnssec]