SIP Detection System and SIP Attack and Abnormal Detection Method Thereby In 4G Mobile Communication

文件类型：PDF文档
文件大小：351K
Disclosed are a system for detecting a session initiation protocol (SIP) attack and an abnormal activity, which can reduce overload and a fault occurring in network equipment, and a method for detecting an SIP attack and an abnormality by the same. According to the present invention, the SIP detection system in a 4G mobile communication network comprises : a subscriber terminal to be connected to an IP multimedia subsystem (IMS) network which provides a VoLTE service to transmit an SIP request message; an IMS to transmit an SIP response message to the subscriber terminal via the IMS network in response to the SIP request message; and an SIP detection device to receive the SIP response message from each subscriber terminal, and calculate an accumulation value accumulated for a period of time predetermined for each subscriber terminal from a response code of an SIP header contained in the received SIP response message to treat as an SIP attack and an abnormal activity if the accumulation value exceeds a threshold. Accordingly, the present invention detects an SIP attack and an abnormal activity in advance based on response SIP traffic to reduce overload and a fault occurring in IMS network equipment and DoS.(110) Attacker terminal(120) SIP scanning detection device(522-1, 522-N) Filter 2(523-1, 523-N) Processing unit(A1, A2) Subscriber terminal (normal terminal)(BB) 4G VoLTE IMS networkCOPYRIGHT KIPO 2016