Authors:
Z. Tsiatsikas
1
;
A. Fakis
1
;
D. Papamartzivanos
1
;
D. Geneiatakis
2
;
G. Kambourakis
1
and
C. Kolias
3
Affiliations:
1
University of the Aegean, Greece
;
2
Aristotle University of Thessaloniki, Greece
;
3
George Mason University, United States
Keyword(s):
Session Initiation Protocol, Machine Learning, DDoS, Anomaly-detection, Intrusion Detection Systems.
Related
Ontology
Subjects/Areas/Topics:
Information and Systems Security
;
Intrusion Detection & Prevention
;
Network Security
;
Wireless Network Security
Abstract:
This paper focuses on network anomaly-detection and especially the effectiveness of Machine Learning (ML)
techniques in detecting Denial of Service (DoS) in SIP-based VoIP ecosystems. It is true that until now several
works in the literature have been devoted to this topic, but only a small fraction of them have done so in an
elaborate way. Even more, none of them takes into account high and low-rate Distributed DoS (DDoS) when
assessing the efficacy of such techniques in SIP intrusion detection. To provide a more complete estimation
of this potential, we conduct extensive experimentations involving 5 different classifiers and a plethora of
realistically simulated attack scenarios representing a variety of (D)DoS incidents. Moreover, for DDoS ones,
we compare our results with those produced by two other anomaly-based detection methods, namely Entropy
and Hellinger Distance. Our results show that ML-powered detection scores a promising false alarm rate in
the general case, and seems t
o outperform similar methods when it comes to DDoS.
(More)