| 摘要 |
PROBLEM TO BE SOLVED: To introduce a novel technique that effectively detects signaling anomalies in VoIP networks. SOLUTION: A communication device receives (301) labeled learning signaling flows and feeds these flows to the database, the signaling flows being labeled as either normal signaling flows or to various signaling flows indicative of attacks. Then, a profile specific classification model is built (307) by using the learning signaling flows contained in the database, the profile being a model that characterizes a signaling flow that corresponds to either a packet, transaction, or dialog. Next, the learning signaling flows are classified (309), the signaling flows being classified as either normal signaling flows, or various signaling flows indicative of attacks, the classification being based on the classification model. COPYRIGHT: (C)2009,JPO&INPIT |
