本文選題：IMS安全　切入點(diǎn)：SBC　出處：《北京郵電大學(xué)》2014年碩士論文　論文類型：學(xué)位論文

【摘要】：IMS已經(jīng)成為NGN的事實(shí)標(biāo)準(zhǔn),隨著運(yùn)營(yíng)商的大力建設(shè)和推廣,IMS技術(shù)將得到更廣泛的應(yīng)用,安全隱患問(wèn)題也將隨之出現(xiàn)。本論文對(duì)IMS的安全問(wèn)題進(jìn)行了調(diào)研和探索,其以IP網(wǎng)作為承載的特點(diǎn),適合引入傳統(tǒng)IP網(wǎng)的防護(hù)手段對(duì)IMS網(wǎng)絡(luò)的安全進(jìn)行防護(hù),而邊緣會(huì)話控制器SBC處于IMS核心網(wǎng)的邊界位置,并且已經(jīng)具備一些安全防護(hù)功能,具備成為IMS網(wǎng)絡(luò)入侵檢測(cè)系統(tǒng)的有利條件,所以為了提高SBC對(duì)IMS核心網(wǎng)的防護(hù)作用,本論文致力于實(shí)現(xiàn)基于SBC的IMS入侵檢測(cè)系統(tǒng),OpenSBC是SBC設(shè)備的一個(gè)開(kāi)源實(shí)現(xiàn),在本論文的開(kāi)發(fā)和測(cè)試過(guò)程中所有用到SBC的場(chǎng)景都使用OpenSBC來(lái)模擬,所以從實(shí)際開(kāi)發(fā)環(huán)境來(lái)看,本論文實(shí)現(xiàn)的是基于OpenSBC的IMS網(wǎng)絡(luò)入侵檢測(cè)系統(tǒng)。 本論文致力基于OpenSBC設(shè)計(jì)和實(shí)現(xiàn)IMS網(wǎng)絡(luò)入侵檢測(cè)系統(tǒng),入侵檢測(cè)系統(tǒng)旨在通過(guò)模式匹配過(guò)濾IMS網(wǎng)絡(luò)中的傳統(tǒng)IP網(wǎng)絡(luò)攻擊報(bào)文以及畸形SIP消息攻擊報(bào)文�；贠penSBC的IMS網(wǎng)絡(luò)的入侵檢測(cè)系統(tǒng)一共由5個(gè)部分組成,分別是數(shù)據(jù)采集模塊、解碼模塊、預(yù)處理模塊、檢測(cè)引擎和與SBC通信模塊。數(shù)據(jù)采集模塊利用LibPcap庫(kù)提供的API完成獲取數(shù)據(jù)包的任務(wù)。解碼器對(duì)采集的數(shù)據(jù)包的各個(gè)字段進(jìn)行解析,讀取并存儲(chǔ)下重要的字段內(nèi)容。預(yù)處理模塊負(fù)責(zé)分片包的重組等需要在檢測(cè)之前進(jìn)行特別處理的工作。檢測(cè)引擎完成入侵檢測(cè)系統(tǒng)的核心工作,把經(jīng)過(guò)上面步驟得到的數(shù)據(jù)包和規(guī)則庫(kù)進(jìn)行比對(duì),過(guò)濾掉相匹配的數(shù)據(jù)包,并將檢測(cè)的結(jié)果通過(guò)與SBC通信模塊傳遞給SBC,本文設(shè)計(jì)的檢測(cè)引擎通過(guò)規(guī)則庫(kù)鏈表和匹配算法的優(yōu)化來(lái)降低檢測(cè)時(shí)延,通過(guò)插件技術(shù)來(lái)解決系統(tǒng)的可擴(kuò)展性問(wèn)題。與SBC通信模塊負(fù)責(zé)入侵檢測(cè)系統(tǒng)和SBC的通信,SBC根據(jù)檢測(cè)結(jié)果進(jìn)行下一步操作。測(cè)試結(jié)果驗(yàn)證了本文所實(shí)現(xiàn)的基于OpenSBC的IMS網(wǎng)絡(luò)入侵檢測(cè)系統(tǒng)能夠有效地過(guò)濾傳統(tǒng)IP網(wǎng)絡(luò)攻擊報(bào)文以及畸形SIP消息攻擊報(bào)文,并且不會(huì)影響SBC的正常工作。
[Abstract]:IMS has become the de facto standard of NGN. With the vigorous construction and promotion of NGN technology by operators, the security hidden problems will also appear. This paper investigates and explores the security problems of IMS. It is suitable for the traditional IP network to protect the security of IMS network, while the edge session controller SBC is located at the boundary of the IMS core network and has some security protection functions. In order to improve the protection of SBC to the core network of IMS, this paper is devoted to the realization of IMS intrusion detection system based on SBC, which is an open source implementation of SBC devices. In the development and testing of this paper, all the scenarios in which SBC is used are simulated by OpenSBC. Therefore, from the point of view of the actual development environment, the IMS network intrusion detection system based on OpenSBC is implemented in this paper. This thesis is devoted to the design and implementation of IMS network intrusion detection system based on OpenSBC. Intrusion detection system (IDS) is designed to filter traditional IP network attack packets and malformed SIP message attack packets in IMS network by pattern matching. The intrusion detection system of IMS network based on OpenSBC consists of five parts: data acquisition module. The decoding module, the preprocessing module, the detection engine and the communication module with SBC. The data acquisition module uses the API provided by the LibPcap library to complete the task of obtaining the data packet. Read and store the important field contents. The preprocessing module is responsible for the recombination of sliced packets and other tasks that need special processing before detection. The detection engine completes the core work of the intrusion detection system. Compare the data packets and rule bases obtained through the above steps, filter out the matching data packets, The detection engine designed in this paper can reduce the detection delay by optimizing the rule base list and matching algorithm. The extensibility of the system is solved by plug-in technology. The communication with SBC module is in charge of the intrusion detection system and the communication between SBC and the system. The test results verify the implementation of this paper based on OpenSBC. IMS network intrusion detection system can effectively filter traditional IP network attack packets and malformed SIP message attack packets. And will not affect the normal operation of SBC.
【學(xué)位授予單位】：北京郵電大學(xué)
【學(xué)位級(jí)別】：碩士
【學(xué)位授予年份】：2014
【分類號(hào)】：TP393.08

【參考文獻(xiàn)】

相關(guān)期刊論文 前10條

1 王玉龍;楊鴻飛;楊逸;;IMS網(wǎng)絡(luò)中畸形SIP信令的快速檢測(cè)[J];北京郵電大學(xué)學(xué)報(bào);2011年06期

2 劉韻潔;;三網(wǎng)融合與未來(lái)網(wǎng)絡(luò)的發(fā)展[J];重慶郵電大學(xué)學(xué)報(bào)(自然科學(xué)版);2010年06期

3 錢麗萍,高光來(lái),李亞萍;基于BPF和LIBPCAP庫(kù)的包捕獲應(yīng)用系統(tǒng)的設(shè)計(jì)[J];電腦學(xué)習(xí);1999年06期

4 張?jiān)朴?彭天煒,張智江,劉韻潔;IMS關(guān)鍵技術(shù)、運(yùn)營(yíng)考慮及演進(jìn)策略[J];電信技術(shù);2005年07期

5 孫敏;;集成式和分布式SBC應(yīng)用探討[J];電信技術(shù);2010年02期

6 費(fèi)宗蓮;;試談IMS網(wǎng)絡(luò)的一種安全解決方案[J];計(jì)算機(jī)安全;2009年04期

7 周慧芳;張亞玲;王尚平;謝寧;馬宏亮;;協(xié)議分析與模式匹配相結(jié)合的IDS的設(shè)計(jì)研究[J];信息技術(shù);2007年08期

8 董曉梅;王麗娜;于戈;王國(guó)仁;;分布式入侵檢測(cè)系統(tǒng)綜述[J];計(jì)算機(jī)科學(xué);2002年03期

9 唐正軍,劉代志;網(wǎng)絡(luò)嗅探器Sniffer軟件源代碼淺析3:采用Libpcap 庫(kù)的通用設(shè)計(jì)[J];計(jì)算機(jī)工程;2002年02期

10 孫宏偉,田新廣,李學(xué)春,張爾揚(yáng);一種改進(jìn)的IDS異常檢測(cè)模型[J];計(jì)算機(jī)學(xué)報(bào);2003年11期

，

本文編號(hào)：1629318