Automatic Adaptation and Analysis of SIP Headers Using Decision Trees
Software implementing open standards like SIP evolves over time, and often during the first years of deployment, products are either immature or do not implement the whole standard but rather only a subset. As a result, messages compliant to the standard are sometimes wrongly rejected and communication fails. In this paper we describe a novel approach called Babel-SIP for increasing the rate of acceptance for SIP messages.
Babel-SIP is a filter that is put in front of a SIP parser and analyzes incoming SIP messages. It gradually learns which messages are likely to be accepted by the parser, and which are not. Those classified as probably rejected are then adapted such that the probability for acceptance is increased. In a number of experiments we demonstrate that our filter is able to drastically increase the acceptance rate of problematic SIP REGISTER and INVITE messages. Additionally we show that our approach can be used to analyze the faulty behavior of a SIP parser by using the generated decision trees.
KeywordsProtocol adaptation Decision tree based learning SIP
Unable to display preview. Download preview PDF.
- 1.Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A., Peterson, J., Sparks, R., Handley, M., Schooler, E.: SIP: Session Initiation Protocol. RFC 3261 (June 2002)Google Scholar
- 3.Heisig, S., Moyle, S.: Using Model Trees to Characterize Computer Resource Usage. In: 1st ACM SIGSOFT Workshop on Self-Managed Systems, pp. 80–84 (2004)Google Scholar
- 4.Abbes, T., Bouhoula, A., Rusinowitch, M.: Protocol Analysis in Intrusion Detection Using Decision Trees. In: International Conference on Information Technology: Coding and Computing (ITCC 2004), pp. 404–408 (2004)Google Scholar
- 5.Kang, H., Zhang, Z., Ranjan, S., Nucci, A.: SIP-based VoIP Traffic Behavior Profiling and Its Applications. In: MineNet 2007, pp. 39–44 (2007)Google Scholar
- 6.Aichernig, B., Peischl, B., Weiglhofer, M., Wotawa, F.: Protocol Conformance Testing a SIP Registrar: an Industrial Application of Formal Methods. In: 5th IEEE Int. Conference on Software Engineering and Formal Methods, pp. 215–224 (2007)Google Scholar
- 7.Abdelnur, H., State, R., Festor, O.: KiF: A Stateful SIP Fuzzer. In: 1st Int. Conference on Principles, Systems and Applications of IP Telecommunications, iptcomm.org (2007)
- 8.Acharya, A., Wand, X., Wrigth, C., Banerjee, N., Sengupta, B.: Real-time Monitoring of SIP Infrastructure Using Message Classification. In: MineNet 2007, pp. 45–50 (2007)Google Scholar
- 9.Rosenberg, J., Schulzrinne, H.: Reliability of provisional responses in session initiation protocol (sip). RFC 3262 (June 2002)Google Scholar
- 10.Rosenberg, J., Schulzrinne, H.: Session initiation protocol (sip): Locating sip servers. RFC 3262 (June 2002)Google Scholar
- 11.Roach, A.B.: Session initiation protocol (sip)-specific event notification. RFC 3265 (June 2002)Google Scholar
- 12.Sparks, R.: The session initiation protocol (sip) refer method. RFC 3515 (April 2003)Google Scholar
- 13.Rosenberg, J.: The session initiation protocol (sip) update method. RFC 3311 (September 2002)Google Scholar
- 14.Johnston, A., Donovan, S., Sparks, R., Cunningham, C., Summers, K.: Session initiation protocol (sip) basic call flow examples. RFC 3665 (December 2003)Google Scholar
- 15.Johnston, A., Donovan, S., Sparks, R., Cunningham, C., Summers, K.: Session initiation protocol (sip) public switched telephone network (pstn) call flows. RFC 3666 (Decmember (2003)Google Scholar
- 16.Marshall, W.: Private session initiation protocol (sip) extensions for media authorization. RFC 3313 (January 2003)Google Scholar
- 17.Peterson, J.: A privacy mechanism for the session initiation protocol (sip). RFC 3323 (November 2002)Google Scholar
- 18.Arkko, J., Torvinen, V., Camarillo, G., Niemi, A., Haukka, T.: Security Mechanism Agreement for the Session Initiation Protocol (SIP). RFC 3329 (January 2003)Google Scholar