System for detecting SIP Denial of Service attack and SPAM attack and method for detecting the same

摘要

PURPOSE: A system for detecting SIP DoS(Denial of Service) attacks and SPAM attacks and a method thereof are provided to detect and block SIP DoS attach packets in a network based on a threshold value to which a call traffic increase state is reflected. CONSTITUTION: An SIP(Session Initiation Protocol) packet decoding module(10) decodes a received SIP packet. A threshold value generating module(20) generates a threshold value per an SIP DoS attack detection rule using the decoded SIP packet. An SIP DoS attack detecting module(40) blocks SIP DoS attack packets from input traffics using a threshold value per an SIP DoS attack detection rule. An SIP SPAM attack detecting module(60) detects an SPAM attack in the input traffics.