DETERMINING VALIDITY OF SIP MESSAGES WITHOUT PARSING

摘要

Methods and apparatus are provided for determining the validity of SIP messages, such as self-similar messages, without parsing the message. A SIP message is processed by creating a feature vector matrix of the SIP message; processing the feature vector matrix using a plurality of classifiers; combining results generated by the plurality of classifiers to obtain a combined resu and processing the SIP message based on the combined result. The plurality of classifiers can be trained on a training data set. The SIP message can optionally be classified, for example, as a normal message or an anomalous message based on the combined result. In addition, the SIP message can optionally be processed or rejected based on the combined result. The results generated by the plurality of classifiers are combined using a combination function, such as a voting rule or a logistic regression.