Improving Anomaly Detection for Text-Based Protocols by Exploiting Message Structures

Future Internet

Martin Güthle¹  Jochen Kögel¹  Stefan Wahl²  Matthias Kaschub¹ 

[1] Institute of Communication Networks and Computer Engineering (IKR), University of Stuttgart, Stuttgart, Germany; E-Mails:;Bell-Labs Germany, Alcatel-Lucent Deutschland AG, Stuttgart, Germany; E-Mail:

关键词: anomaly detection;    classification;    text-based protocols;    SIP;    SVM;   

DOI  :  10.3390/fi2040662

来源: mdpi

【 摘 要 】

Service platforms using text-based protocols need to be protected against attacks. Machine-learning algorithms with pattern matching can be used to detect even previously unknown attacks. In this paper, we present an extension to known Support Vector Machine (SVM) based anomaly detection algorithms for the Session Initiation Protocol (SIP). Our contribution is to extend the amount of different features used for classification (feature space) by exploiting the structure of SIP messages, which reduces the false positive rate. Additionally, we show how combining our approach with attribute reduction significantly improves throughput.

【 授权许可】

CC BY   
© 2010 by the authors; licensee MDPI, Basel, Switzerland.