Re: [sip-clf] anomaly detectors (was: SIP-CLF slides for opsarea and possibly ipfix)

[Hadriel Kaplan <[e-mail]>]

> -----Original Message-----
> From: Vijay K. Gurbani [mailto:[e-mail]]
> Sent: Friday, July 24, 2009 5:32 PM
> 
> Hadriel Kaplan wrote:
> > It's not so much that it's a research topic, but rather that some of
> > the needs of anomaly detection literally require getting the entire
> > SIP message (or at least a lot more than what we're proposing as the
> > baseline header info).  Even the currently *deployed* anomaly
> > detectors check more than what the current drafts are proposing to
> > include in a CLF.
> 
> Currently deployed anomaly detection systems that I am aware
> of perform mostly at the parsing layer to determine whether or
> not a SIP message is well-formed -- hence they need the whole
> SIP message.  Are you aware of any anomaly detection systems that
> do semantic anomaly detection for SIP above and beyond the
> parsing layer?

Yes, of course.  You do know I work for an SBC vendor, right? :)
SBC's do anomaly detection both at the parser layer _and_ at higher layers, and have been for years.  Some of us just don't call the higher layer things "anomaly detection" - because we market it more on the actions we take once we detect an anomaly (like reject or log or blacklist), or the benefit to the customer (like "Fraud Prevention", "Hijack prevention", "DDoS protection", "SPIT Protection", etc.).  

But anyway, there are centralized "anomaly detectors" that purport to analyze "anomalies" too - I don't know what all they mean by that, but they've asked us to provide them SIP message feeds (which right now is basically everything).  If I was them and looked at a CLF, I'd want to get quite a bit more than what we define: Via's, Route's, Record-Route's, Refer-To's, P-Asserted/P-Preferred/Remote-Party-ID, Path's, Max-Forwards, Content-Type's, History-Info, and Diversion... just off the top of my head.  

And really, as an "anomaly detector" I would want to filter which headers I *don't* care-about, not which I do. 

-hadriel