{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,16]],"date-time":"2026-06-16T13:53:58Z","timestamp":1781618038739,"version":"3.54.5"},"publisher-location":"Cham","reference-count":6,"publisher":"Springer International Publishing","isbn-type":[{"value":"9783319607733","type":"print"},{"value":"9783319607740","type":"electronic"}],"license":[{"start":{"date-parts":[[2017,1,1]],"date-time":"2017-01-01T00:00:00Z","timestamp":1483228800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2017,1,1]],"date-time":"2017-01-01T00:00:00Z","timestamp":1483228800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2017]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Extended flow records with application layer (L7) information allow for detection of various types of malicious traffic. Voice over IP (VoIP) is an example of technology that works on L7 and many attacks against it cannot be reliably detected using just basic flow information. Session Initiation Protocol (SIP), which is commonly used for VoIP signalling, is a frequent target of many types of attacks. This paper proposes and evaluates a novel algorithm for near real time detection of username scanning and password guessing attacks on SIP servers. The detection is based on analysis of L7 extended flow records.<\/jats:p>","DOI":"10.1007\/978-3-319-60774-0_9","type":"book-chapter","created":{"date-parts":[[2017,6,16]],"date-time":"2017-06-16T12:23:19Z","timestamp":1497615799000},"page":"125-130","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Hunting SIP Authentication Attacks Efficiently"],"prefix":"10.1007","author":[{"given":"Tom\u00e1\u0161","family":"Jansky","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tom\u00e1\u0161","family":"\u010cejka","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"V\u00e1clav","family":"Barto\u0161","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2017,6,17]]},"reference":[{"key":"9_CR1","doi-asserted-by":"crossref","unstructured":"Cejka, T., Bartos, V., Svepes, M., Rosa, Z., Kubatova, H.: NEMEA: a framework for network traffic analysis. In: 12th International Conference on Network and Service Management (CNSM 2016), Montreal, Canada, October 2016","DOI":"10.1109\/CNSM.2016.7818417"},{"key":"9_CR2","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"87","DOI":"10.1007\/978-3-319-20034-7_10","volume-title":"Intelligent Mechanisms for Network Configuration and Security","author":"T Cejka","year":"2015","unstructured":"Cejka, T., Bartos, V., Truxa, L., Kubatova, H.: Using application-aware flow monitoring for sip fraud detection. In: Latr\u00e9, S., Charalambides, M., Fran\u00e7ois, J., Schmitt, C., Stiller, B. (eds.) AIMS 2015. LNCS, vol. 9122, pp. 87\u201399. Springer, Cham (2015). doi:10.1007\/978-3-319-20034-7_10"},{"key":"9_CR3","unstructured":"Communication Fraud Control Association: Global fraud loss survey (2015). http:\/\/www.cfca.org\/pdfsurvey\/2015_CFCA_Global_Fraud_Loss_Survey_Press_Release.pdf"},{"key":"9_CR4","volume-title":"Hacking VoIP: Protocols, Attacks, and Countermeasures","author":"H Dwivedi","year":"2009","unstructured":"Dwivedi, H.: Hacking VoIP: Protocols, Attacks, and Countermeasures. No Starch Press, San Francisco (2009)"},{"key":"9_CR5","unstructured":"Gauci, S.: SIPVicious. Tools for auditing sip based VoIP systems (2012). https:\/\/code.google.com\/p\/sipvicious\/"},{"key":"9_CR6","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"173","DOI":"10.1007\/978-3-662-43862-6_20","volume-title":"Monitoring and Securing Virtualized Networks and Services","author":"P Velan","year":"2014","unstructured":"Velan, P., \u010celeda, P.: Next generation application-aware flow monitoring. In: Sperotto, A., Doyen, G., Latr\u00e9, S., Charalambides, M., Stiller, B. (eds.) AIMS 2014. LNCS, vol. 8508, pp. 173\u2013178. Springer, Heidelberg (2014). doi:10.1007\/978-3-662-43862-6_20"}],"container-title":["Lecture Notes in Computer Science","Security of Networks and Services in an All-Connected World"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-319-60774-0_9","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,7,11]],"date-time":"2023-07-11T14:03:49Z","timestamp":1689084229000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-319-60774-0_9"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2017]]},"ISBN":["9783319607733","9783319607740"],"references-count":6,"URL":"https:\/\/doi.org\/10.1007\/978-3-319-60774-0_9","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2017]]},"assertion":[{"value":"17 June 2017","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"AIMS","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"IFIP International Conference on Autonomous Infrastructure, Management and Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Zurich","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Switzerland","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2017","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"10 July 2017","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"13 July 2017","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"11","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"aims2017","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}