A carregar...
Publicação
Error and Fault detection IMS
| Nome: | Descrição: | Tamanho: | Formato: | |
|---|---|---|---|---|
| 7.8 MB | Adobe PDF |
Orientador(es)
Resumo(s)
Nesta dissertação são estudados métodos de classificação de registos fraudulentos na
rede IMS de uma operadora de telecomunicações, com o objectivo de detectar utilizações
fraudulentas.
O registo de terminais e usurpação da password dos mesmos representa um problema
de segurança para as operadoras, uma vez que os recursos dos clientes são violados e,
o atacante pode usar a conta a que ganha acesso para cobrar à operadora serviços aos
quais não tem direito. Para além das consequências de um ataque bem sucedido, as
repetidas tentativas que um utilizador malicioso acaba por fazer para obter uma conta
consomem recursos que a operadora poderia estar a alocar aos seus clientes pagos. Para
evitar este processo foram desenvolvidos e testados diversos mecanismos de classificação
de mensagens SIP com cabeçalho REGISTER.
Foram estudados mecanismos de classificação supervisionada e não supervisionada
de forma a perceber qual o modelo que mais se adequa ao problema proposto.
Por fim, um dos modelos criados foi escolhido para implementação, tendo em consi-
deração as necessidades da operadora.
O modelo escolhido é capaz de analisar os pedidos de registo com destino à rede
da operadora durante um determinado período de tempo e, reportar casos de ataque à
equipa de supervisão. Desta forma, a operadora é capaz de detectar os ataques no início
de execução e bloquear as comunicações do atacante se assim o entender.
In this dissertation, we will study a classification method for fraudulent SIP register traffic in a IMS network of a telecommunications operator. The registration of an IMS terminal and usurpation of the account’s password rep- resents a security problem for telecom companies, since the resources of the real client are being violated and the malicious client might use the usurped account to charge the telecom company with services that he is not allowed to use. Besides the consequences of a successful attack, the enormous amount of register requests sent by the malicious user to break into an account, are consuming network resources that could be used by paying clients. In order to avoid this type of network problems, this dissertation aims to develop and test several classification mechanisms for SIP messages with a REGISTER header. Supervised and unsupervised machine learning algorithms were used as classification methods. The chosen algorithms were trained and tested in order to understand which one would be the best to satisfy the operator needs. One of the trained algorithms was chosen to be implemented in a network scan appli- cation. The deployed mechanism is able to scan and classify all suspicious SIP register requests sent to the telecom company’s IP addresses, for a given period of time. The classification result is sent to the network supervision team. This artificial intelligence mechanism gives the telecom company the ability to detect and block malicious traffic in the early stages of an attack.
In this dissertation, we will study a classification method for fraudulent SIP register traffic in a IMS network of a telecommunications operator. The registration of an IMS terminal and usurpation of the account’s password rep- resents a security problem for telecom companies, since the resources of the real client are being violated and the malicious client might use the usurped account to charge the telecom company with services that he is not allowed to use. Besides the consequences of a successful attack, the enormous amount of register requests sent by the malicious user to break into an account, are consuming network resources that could be used by paying clients. In order to avoid this type of network problems, this dissertation aims to develop and test several classification mechanisms for SIP messages with a REGISTER header. Supervised and unsupervised machine learning algorithms were used as classification methods. The chosen algorithms were trained and tested in order to understand which one would be the best to satisfy the operator needs. One of the trained algorithms was chosen to be implemented in a network scan appli- cation. The deployed mechanism is able to scan and classify all suspicious SIP register requests sent to the telecom company’s IP addresses, for a given period of time. The classification result is sent to the network supervision team. This artificial intelligence mechanism gives the telecom company the ability to detect and block malicious traffic in the early stages of an attack.
Descrição
Palavras-chave
Inteligência Artificial IMS Cibersegurança SIP