• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.3 no.5
• /
• pp.507-526
• /
• 2009

Since SIP uses a text-based message format and is open to the public Internet, it provides a number of potential opportunities for Denial of Service (DoS) attacks in a similar manner to most Internet applications. In this paper, we propose an effective detection method for SIP flooding attacks in order to deal with the problems of conventional schemes. We derive the upper bound of the possible number of SIP messages, considering not only the network congestion status but also the different properties of individual SIP messages such as INVITE, BYE and CANCEL. The proposed method can be easily extended to detect flooding attacks by other SIP messages.

• Proceedings of the Korean Information Science Society Conference
• /
• 2011.06d
• /
• pp.135-136
• /
• 2011

The more VoIP service is widely used, the more VoIP spam becomes threatened. Both VoIP spam violates the user's privacy and VoIP spam can cause money trouble. Therefore, it is important to reduce the VoIP spam but it is not easy to adopt some useful techniques to counter e-mail spam due to VoIP characteristics. We propose a technique using VoIP-RBL for countering SIP-based VoIP spam.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2014.11a
• /
• pp.449-452
• /
• 2014

최근 이동통신 사업자들은 All-IP 기반의 서비스를 개발하고 상용화하기 위해 힘쓰고 있다. 그 이유는 All-IP 기반의 서비스가 LTE의 넓은 대역폭을 사용하여 기존 서비스와는 현저한 차별성을 가지고 있기 때문이다. 음성통화를 LTE 기반으로 제공하는 VoLTE 서비스도 그 중의 하나로서 현재 이동통신 3사 모두 상용화하여 이 새로운 고음질 및 고화질 커뮤니케이션 서비스에 대해 마케팅을 벌이고 있다. 하지만 VoLTE 서비스는 보안에 대한 충분한 고려가 이루어지지 않은 상태로 상용화되었으며, VoLTE에서 사용되는 SIP(Session Initiation Protocol) 프로토콜을 악용한 여러 유형의 공격에 매우 취약하다. 본 논문에서는 VoLTE 서비스에 대한 보안 위협 중 가장 기본이 되는 스캐닝 공격에 대해 기술하고 이를 탐지할 수 있는 방안을 제시한다.

• The Journal of the Korea Contents Association
• /
• v.11 no.12
• /
• pp.88-93
• /
• 2011

Due to vulnerable authentication scheme of SIP, intruders can easily impersonate legitimate user. HTTP Digest authentication scheme or private key issued by trust third parties has been used to prevent impersonation attack. However, these methods have suffered security vulnerability or service delay due to computation overhead. In this paper, we propose new authentication method to generate automatically one-time password using the pre-shared password and time information of messages exchanged between SIP UA(User Agent) and SIP Registrar. This method protects against impersonation attack without significant modification of exiting SIP authentication procedure to build securer SIP environment.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.11 no.1
• /
• pp.130-140
• /
• 2010

SIP (Session Initiation Protocol) is a signaling protocol to provide IP-based VoIP (Voice over IP) service. However, many security vulnerabilities exist as the SIP protocol utilizes the existing IP based network. The SIP Malformed message attacks may cause malfunction on VoIP services by changing the transmitted SIP header information. Additionally, there are several threats such that an attacker can extract personal information on SIP client system by inserting malicious code into SIP header. Therefore, the alternative measures should be required. In this study, we analyzed the existing research on the SIP anomaly message detection mechanism against SIP attack. And then, we proposed a Co-occurrence based SIP packet analysis mechanism, which has been used on language processing techniques. We proposed a association rule generation and an attack detection technique by using the actual SIP session state. Experimental results showed that the average detection rate was 87% on SIP attacks in case of using the proposed technique.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.6
• /
• pp.1411-1420
• /
• 2015

Lawful interception(LI) standard of telephone networks has technical limitations to lawfully intercept IMS/SIP-based mobile communication network subscriber who using Android and iPhone device. In addition, the technical standards related to legal interception of the IMS/SIP of the wireless network is insufficient compared to the systematic study of the development of a wireless network infrastructure. The architecture proposed in the standard of ETSI(European Telecommunications Standards Institute) for the seamless LI is insufficient to overcome the limitations of traditional voice-centric LI techniques. This paper proposes an IMS/SIP-based architecture to perform LI under 3G networks that focuses on mobility-supported environments with merging cellular networks and the Internet. We implemented the simulation to verify the efficiency of the proposed architecture, and the experimental results show that our method achieves higher lawful interception rate than that of existing interception methods.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.30 no.7B
• /
• pp.464-468
• /
• 2005

The DVR industry has been grown with their own, proprietary systems without the need of standards because the security products are independently installed in small scale and the communication needs are very limited. The industry might have tighter security than having standardized products, but the appearance of IP surveillance and the need of communications with IP products such as IP Phones and IP-PBX made the standardization unavoidable. In this paper, we built an IP surveillance system with SIP based session control and investigated the applications of it other than the security itself.

• Journal of information and communication convergence engineering
• /
• v.6 no.1
• /
• pp.68-72
• /
• 2008

The VoIP(Voice over IP) has been worldwide used and already put to practical use in many fields. However, it is needed to ensure secret of VoIP call in a special situation. It is relatively difficult to eaves-drop the commonly used PSTN in that it is connected with 1:1 circuit. However, it is difficult to ensure the secret of call on Internet because many users can connect to the Internet at the same time. Therefore, this paper suggests a new model of Internet telephone for eavesdrop prevention enabling VoIP(using SIP protocol) to use the VPN protocol and establish the probability of practical use comparing it with Internet telephone.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2011.11a
• /
• pp.626-628
• /
• 2011

인터넷이 발전함에 따라 기존의 PSTN(Public Switch Telephone Network)망이 감소하고 VoIP 서비스가 증가하고 있다. VoIP 서비스가 기존의 인터넷을 기반으로 서비스가 되어 보안문제까지 같이 떠안게 되었다. 이에 VoIP상의 다양한 공격에 대한 분석 및 효율적인 탐지 방법이 연구 되고 있다. 본 연구에서는 공격 중에서 SIP 상에서의 INVITE Flooding 공격에 대해 분석하고, 기존의 탐지 알고리즘을 연구하여 오탐율이 개선된 탐지 알고리즘을 제안한다.

• Journal of the Korea Society of Computer and Information
• /
• v.14 no.12
• /
• pp.169-180
• /
• 2009

Generally home networks are based on wired network and wireless network. This makes customers be capable of using electric home appliances and full-duplex multimedia services and controlling the machines without any restrictions of place or time. Now that the scope of home security is being extended, the home networks can be formed with not only personal computer but also home automation, electric home appliances, and etc. But this causes many of attacks of invasion and damages. Therefore in this paper we suggest the SSIP(Secure Session Initiate protocol) model for solving those problems. The SSIP model is able to provide an efficient authentication and reduce the time of session re-establishment and set-up by adding ability of SIP authentication to Cluster-to-Cluster environment performed on home gateway.