DECTECTION METHOD AND APPARATUS OF SIP(SESSION INITIATION PROTOCOL) BYE FLOODING ATTACKS BASED ON THE UPPER BOUND OF POSSIBLE NUMER OF SIP MESSAGES

摘要

PURPOSE: A SIP(Session Initiation Protocol) BYE flooding attack detection method and apparatus thereof are provided to perform SIP BYE flooding attack detection by reflecting a network situation in real time. CONSTITUTION: A threshold generating unit(10) obtains a possible threshold value of a BYE message number from a present unit time. A weighted average generating unit obtains the average BYE message numbers at the present unit time by using a weighted average BYE message number at a previous unit time of the present unit time and the number of deduced BYE messages. An attack decision unit(12) determines whether or not to compare the threshold value of the BYE message number to the following weighting average BYE message number at the present unit time. The attack decision unit determines a BYE message flooding attack at the present unit time.