Transaction-Pattern-Based Anomaly Detection Algorithm for IP Multimedia Subsystem

The Internet Protocol (IP) multimedia subsystem (IMS) plays an important role when migrating to next-generation networks. Based on the all-IP network architecture, at least an IP address is assigned to user equipment for communication. It thus brings not only value-added services, but also security issues such as attacks and threats from traditional IP networks. This paper proposes a novel scheme to detect the anomaly attempts or attacks in an IMS core network. Our proposed scheme adopts the support vector machines (SVMs) technique as our data-mining module. We also utilize the high-order Markov kernel to enhance the detection and prediction rate in sequence calls. Furthermore, the detection algorithm and feature selection for SVM kernel are designed by utilizing IMS transaction patterns. It is proved that the proposed algorithm can efficiently filter out the anomaly attempts in an IMS core network.