SIP 프로토콜 상태정보 기반 공격 탐지 기능을 제공하는 가상 프록시 서버 설계 및 구현 = Stateful Virtual Proxy Server for Attack Detection based on SIP Protocol State Monitoring Mechanism

다국어 초록 (Multilingual Abstract)

VoIP service is a transmission of voice data using SIP protocol on IP based network. The SIP protocol has many advantages such as providing IP based voice communication and multimedia service with cheap communication cost and so on. Therefore the SIP protocol spread out very quickly. But, SIP protocol exposes new forms of vulnerabilities on malicious attacks such as Message Flooding attack and protocol parsing attack. And it also suffers threats from many existing vulnerabilities like on IP based protocol. In this paper, we propose a new Virtual Proxy Server system in front of the existed Proxy Server for anomaly detection of SIP attack and stateful management of SIP session with enhanced security. Based on stateful virtual proxy server, out solution shows promising SIP Message Flooding attack verification and detection performance with minimized latency on SIP packet transmission.

참고문헌 (Reference)

1 구자현, "VoIP서비스 보안 취약성 분석" 16 (16): 60-63, 2006

2 한국정보보호진흥원, "VoIP 정보보호 가이드" 2005

3 박진범, "VoIP 보안 취약점 공격에 대한 기존 보안장비의 대응 분석 연구" 한국정보보호학회 17 (17): 57-65, 2007

4 한국전자통신연구원(ETRI), "VoIP 기술 및 시장 동향" 4-13, 2006

5 "VoIP 국내표준, H.323 기반 인터넷 텔레포니 단말, SIP 기반 인터넷 텔레포니 단말"

6 M.Collier, "VoIP Vulnerabilities Registration Hijacking" SecureLogix Corporation 1-4, 2005

7 H.Sengar, "VoIP Intrusion Detection Through Inter- acting Protocol State Machines" 2006

8 Jay Beale, "Snort 2.0 Intrusion Detection" 2003

9 D.Richard Kuhn, "Security Consideration for Voice over IP Systems" NIST 10-13-19-44, 2005

10 D.Malas., "SIP performance metrics, Internet draft draft-malas-performance-metrics-06.txt (work in progress), IETF"

11 D.Powell, "Enterprise Security Management(ESM):Centralizing Management of Your Security Policy" SANS Info 2002