ImageVerifierCode 换一换
格式:DOCX , 页数:11 ,大小:25.80KB ,
资源ID:30306601      下载积分:3 金币
快捷下载
登录下载
邮箱/手机:
温馨提示:
快捷下载时,用户名和密码都是您填写的邮箱或者手机号,方便查询和重复下载(系统自动生成)。 如填写123,账号就是123,密码也是123。
特别说明:
请自助下载,系统不会自动发送文件的哦; 如果您已付费,想二次下载,请登录后访问:我的下载记录
支付方式: 支付宝    微信支付   
验证码:   换一换

加入VIP,免费下载
 

温馨提示:由于个人手机设置不同,如果发现不能下载,请复制以下地址【https://www.bdocx.com/down/30306601.html】到电脑端继续下载(重复下载不扣费)。

已注册用户请登录:
账号:
密码:
验证码:   换一换
  忘记密码?
三方登录: 微信登录   QQ登录  

下载须知

1: 本站所有资源如无特殊说明,都需要本地电脑安装OFFICE2007和PDF阅读器。
2: 试题试卷类文档,如果标题没有明确说明有答案则都视为没有答案,请知晓。
3: 文件的所有权益归上传用户所有。
4. 未经权益所有人同意不得将文件中的内容挪作商业或盈利用途。
5. 本站仅提供交流平台,并不能对任何下载内容负责。
6. 下载文件中如有侵权或不适当内容,请与我们联系,我们立即纠正。
7. 本站不保证下载资源的准确性、安全性和完整性, 同时也不承担用户因使用这些下载资源对自己和他人造成任何形式的伤害或损失。

版权提示 | 免责声明

本文(通信类英文文献及翻译.docx)为本站会员(b****8)主动上传,冰豆网仅提供信息存储空间,仅对用户上传内容的表现方式做保护处理,对上载内容本身不做任何修改或编辑。 若此文所含内容侵犯了您的版权或隐私,请立即通知冰豆网(发送邮件至service@bdocx.com或直接QQ联系客服),我们立即给予删除!

通信类英文文献及翻译.docx

1、通信类英文文献及翻译姓名:刘峻霖 班级:通信143班 学号:2014101108附 录一、英文原文:Detecting Anomaly Trafc using Flow Data in the real VoIP networkI. INTRODUCTIONRecently, many SIP3/RTP4-based VoIP applications and services have appeared and their penetration ratio is gradually increasing due to the free or cheap call charge and th

2、e easy subscription method. Thus, some of the subscribers to the PSTN service tend to change their home telephone services to VoIP products. For example, companies in Korea such as LG Dacom, Samsung Net- works, and KT have begun to deploy SIP/RTP-based VoIP services. It is reported that more than ve

3、 million users have subscribed the commercial VoIP services and 50% of all the users are joined in 2009 in Korea 1. According to IDC, it is expected that the number of VoIP users in US will increase to 27 millions in 2009 2. Hence, as the VoIP service becomes popular, it is not surprising that a lot

4、 of VoIP anomaly trafc has been already known 5. So, Most commercial service such as VoIP services should provide essential security functions regarding privacy, authentication, integrity and non-repudiation for preventing malicious trafc. Particu- larly, most of current SIP/RTP-based VoIP services

5、supply the minimal security function related with authentication. Though secure transport-layer protocols such as Transport Layer Security (TLS) 6 or Secure RTP (SRTP) 7 have been standardized, they have not been fully implemented and deployed in current VoIP applications because of the overheads of

6、 implementation and performance. Thus, un-encrypted VoIP packets could be easily sniffed and forged, especially in wireless LANs. In spite of authentication,the authentication keys such as MD5 in the SIP header could be maliciously exploited, because SIP is a text-based protocol and unencrypted SIP

7、packets are easily decoded. Therefore, VoIP services are very vulnerable to attacks exploiting SIP and RTP. We aim at proposing a VoIP anomaly trafc detection method using the ow-based trafc measurement archi-tecture. We consider three representative VoIP anomalies called CANCEL, BYE Denial of Servi

8、ce (DoS) and RTP ooding attacks in this paper, because we found that malicious users in wireless LAN could easily perform these attacks in the real VoIP network. For monitoring VoIP packets, we employ the IETF IP Flow Information eXport (IPFIX) 9 standard that is based on NetFlow v9. This trafc meas

9、urement method provides a exible and extensible template structure for various protocols, which is useful for observing SIP/RTP ows 10. In order to capture and export VoIP packets into IPFIX ows, we dene two additional IPFIX templates for SIP and RTP ows. Furthermore, we add four IPFIX elds to obser

10、ve 802.11 packets which are necessary to detect VoIP source spoong attacks in WLANs.II. RELATED WORK8 proposed a ooding detection method by the Hellinger Distance (HD) concept. In 8, they have pre- sented INVITE, SYN and RTP ooding detection meth-ods. The HD is the difference value between a trainin

11、g data set and a testing data set. The training data set collected trafc over n sampling period of duration t.The testing data set collected trafc next the training data set in the same period. If the HD is close to 1, this testing data set is regarded as anomaly trafc. For using this method, they a

12、ssumed that initial training data set did not have any anomaly trafc. Since this method was based on packet counts, it might not easily extended to detect other anomaly trafc except ooding. On the other hand, 11 has proposed a VoIP anomaly trafc detection method using Extended Finite State Machine (

13、EFSM). 11 has suggested INVITE ooding, BYE DoS anomaly trafc and media spamming detection methods. However, the state machine required more memory because it had to maintain each ow. 13 has presented NetFlow-based VoIP anomaly detection methods for INVITE, REGIS-TER, RTP ooding, and REGISTER/INVITE

14、scan. How-ever, the VoIP DoS attacks considered in this paper were not considered. In 14, an IDS approach to detect SIP anomalies was developed, but only simulation results are presented. For monitoring VoIP trafc, SIPFIX 10 has been proposed as an IPFIX extension. The key ideas of the SIPFIX are ap

15、plication-layer inspection and SDP analysis for carrying media session information. Yet, this paper presents only the possibility of applying SIPFIX to DoS anomaly trafc detection and prevention. We described the preliminary idea of detecting VoIP anomaly trafc in 15. This paper elaborates BYE DoS a

16、nomaly trafc and RTP ooding anomaly trafc detec-tion method based on IPFIX. Based on 15, we have considered SIP and RTP anomaly trafc generated in wireless LAN. In this case, it is possible to generate the similiar anomaly trafc with normal VoIP trafc, because attackers can easily extract normal use

17、r information from unencrypted VoIP packets. In this paper, we have extended the idea with additional SIP detection methods using information of wireless LAN packets. Furthermore, we have shown the real experiment results at the commercial VoIP network.III. THE VOIP ANOMALY TRAFFIC DETECTION METHODA

18、. CANCEL DoS Anomaly Trafc Detection As the SIP INVITE message is not usually encrypted, attackers could extract elds necessary to reproduce the forged SIP CANCEL message by snifng SIP INVITE packets, especially in wireless LANs. Thus, we cannot tell the difference between the normal SIP CANCEL mess

19、age and the replicated one, because the faked CANCEL packet includes the normal elds inferred from the SIP INVITE message. The attacker will perform the SIP CANCEL DoS attack at the same wireless LAN, because the purpose of the SIP CANCEL attack is to prevent the normal call estab-lishment when a vi

20、ctim is waiting for calls. Therefore, as soon as the attacker catches a call invitation message for a victim, it will send a SIP CANCEL message, which makes the call establishment failed. We have generated faked SIP CANCEL message using sniffed a SIP INVITE message.Fields in SIP header of this CANCE

21、L message is the same as normal SIP CANCEL message, because the attacker can obtain the SIP header eld from unencrypted normal SIP message in wireless LAN environment. Therefore it is impossible to detect the CANCEL DoS anomaly trafc using SIP headers, we use the different values of the wireless LAN

22、 frame. That is, the sequence number in the 802.11 frame will tell the difference between a victim host and an attacker. We look into source MAC address and sequence number in the 802.11 MAC frame including a SIP CANCEL message as shown in Algorithm 1. We compare the source MAC address of SIP CANCEL

23、 packets with that of the previously saved SIP INVITE ow. If the source MAC address of a SIP CANCEL ow is changed, it will be highly probable that the CANCEL packet is generated by a unknown user. However, the source MAC address could be spoofed. Regarding 802.11 source spoong detection, we employ t

24、he method in 12 that uses sequence numbers of 802.11 frames. We calculate the gap between n-th and (n-1)-th 802.11 frames. As the sequence number eld in a 802.11 MAC header uses 12 bits, it varies from 0 to 4095. When we nd that the sequence number gap between a single SIP ow is greater than the thr

25、eshold value of N that will be set from the experiments, we determine that the SIP host address as been spoofed for the anomaly trafc.B. BYE DoS Anomaly Trafc DetectionIn commercial VoIP applications, SIP BYE messages use the same authentication eld is included in the SIP IN-VITE message for securit

26、y and accounting purposes. How-ever, attackers can reproduce BYE DoS packets through snifng normal SIP INVITE packets in wireless LANs.The faked SIP BYE message is same with the normal SIP BYE. Therefore, it is difcult to detect the BYE DoS anomaly trafc using only SIP header information.After snifn

27、g SIP INVITE message, the attacker at the same or different subnets could terminate the normal in- progress call, because it could succeed in generating a BYE message to the SIP proxy server. In the SIP BYE attack, it is difcult to distinguish from the normal call termination procedure. That is, we

28、apply the timestamp of RTP trafc for detecting the SIP BYE attack. Generally, after normal call termination, the bi-directional RTP ow is terminated in a bref space of time. However, if the call termination procedure is anomaly, we can observe that a directional RTP media ow is still ongoing, wherea

29、s an attacked directional RTP ow is broken. Therefore, in order to detect the SIP BYE attack, we decide that we watch a directional RTP ow for a long time threshold of N sec after SIP BYE message. The threshold of N is also set from the experiments.Algorithm 2 explains the procedure to detect BYE Do

30、S anomal trafc using captured timestamp of the RTP packet. We maintain SIP session information between clients with INVITE and OK messages including the same Call-ID and 4-tuple (source/destination IP Address and port number) of the BYE packet. We set a time threshold value by adding Nsec to the tim

31、estamp value of the BYE message. The reason why we use the captured timestamp is that a few RTP packets are observed under 0.5 second. If RTP trafc is observed after the time threshold, this will be considered as a BYE DoS attack, because the VoIP session will be terminated with normal BYE messages.

32、 C. RTP Anomaly Trafc Detection Algorithm 3 describes an RTP ooding detection method that uses SSRC and sequence numbers of the RTP header. During a single RTP session, typically, the same SSRC value is maintained. If SSRC is changed, it is highly probable that anomaly has occurred. In addition, if there is a big sequence number gap between RTP packets, we determine that anomaly RTP trafc has happened. As inspecting every sequence number for a packet is difcult, we calculate the sequence number gap using the rst, last, maximum and minimum sequence numb

copyright@ 2008-2022 冰豆网网站版权所有

经营许可证编号:鄂ICP备2022015515号-1