基于C4.5决策树的IMS网络畸形SIP消息检测方法

Detection Method for Malformed SIP Messages Based on C4.5 Decision Tree in IMS Network

针对现有方法对与正常消息相似度较高的畸形SIP消息检测效果不佳的问题,提出了一种基于C4.5决策树的IMS网络畸形SIP消息检测方法。该方法首先利用n-gram技术将SIP消息映射至高维空间,利用样本属性的信息增益进行特征提取;然后基于C4.5决策树算法,根据特征属性的信息增益率构建决策树并对畸形SIP消息进行检测;最后定义了畸形SIP消息构造函数并构建相应样本数据集,对该方法进行了仿真验证。仿真结果表明,该方法对与正常消息相似度较高的畸形SIP消息具有94.8%的检测率。

In order to solve the problem that the existing detection methods couldn＇ t effectively de- tect the malformed SIP messages which are extremely similar to the normal messages, this paper pro- poses a detection method for malformed SIP messages based on C4.5 Decision Tree. First,this meth- od maps the SIP messages to a high dimension space using the n-gram technique, and extracts the characteristics based on the information gain of sample attribute. And then,a decision tree model is built using the information gain ratio of the features, and malformed SIP messages are detected through seeking in the decision tree model. Finally, with the definition of the construction functions of such kinds of SIP messages and the corresponding sample messages set, the method is demonstra- ted by simulations. Simulation results prove that this method could detect the malformed messages that are extremely similar to the normal ones with 94.8% detection rate.