Correlation-Based Abnormal SIP Dialog Identification

Abstract

The Session Initiation Protocol (SIP) is crucial in establishing, maintaining, and terminating multimedia sessions. It is particularly vital for the operation of 4G/5G networks, where the network’s low latency and high reliability enable advanced services such as real-time video streaming and Internet of Things applications. The widespread use of SIP in various network generations emphasizes the need for robust security mechanisms to protect against potential vulnerabilities. SIP is susceptible to various attacks, including registration hijacking, call tampering, and denial of service. A specific threat arises from exploiting unknown or abnormal SIP dialogs to uncover weaknesses in the different SIP implementations running on servers. In this paper, we propose an innovative methodology for anomalous SIP dialog detection based on prior knowledge of observed correct and anomalous SIP dialogs. The proposed approach leverages cross-correlation techniques to score the similarity of the SIP dialogs and the use of statistical metrics to classify the anomalous ones. Our method achieves an accuracy of approximately 98.91%. We compare its performance with the optimal Bayesian solution, a deep learning-based approach, and a hybrid method using both deep-learning and statistical methods. While our solution is close to the optimal accuracy, it does not achieve the lowest false alarm rate. However, it offers a significant advantage in computational efficiency, being over 1000 times faster than both the optimal Bayesian and deep learning methods. These findings underscore the potential of the proposed technique for real-time detection of abnormal SIP dialogs in high-performance network environments. Cross-correlation was also employed to predict the SIP ID of ongoing SIP dialogs before their full arrival. Although this method was faster than the other studied methods, its predictive performance was suboptimal, achieving high accuracy only when over 90% of the data was available. Based on these findings, we conclude that the proposed method has high performance in classification tasks with faster computational times than alternative methods, while it is less effective for prediction tasks were other methods achieve higher performance.