Automatic Adaptation and Analysis of SIP Headers Using Decision Trees

  • Andrea Hess
  • Michael Nussbaumer
  • Helmut Hlavacs
  • Karin Anna Hummel
Part of the Lecture Notes in Computer Science book series (LNCS, volume 5310)


Software implementing open standards like SIP evolves over time, and often during the first years of deployment, products are either immature or do not implement the whole standard but rather only a subset. As a result, messages compliant to the standard are sometimes wrongly rejected and communication fails. In this paper we describe a novel approach called Babel-SIP for increasing the rate of acceptance for SIP messages.

Babel-SIP is a filter that is put in front of a SIP parser and analyzes incoming SIP messages. It gradually learns which messages are likely to be accepted by the parser, and which are not. Those classified as probably rejected are then adapted such that the probability for acceptance is increased. In a number of experiments we demonstrate that our filter is able to drastically increase the acceptance rate of problematic SIP REGISTER and INVITE messages. Additionally we show that our approach can be used to analyze the faulty behavior of a SIP parser by using the generated decision trees.


Protocol adaptation Decision tree based learning SIP 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston, A., Peterson, J., Sparks, R., Handley, M., Schooler, E.: SIP: Session Initiation Protocol. RFC 3261 (June 2002)Google Scholar
  2. 2.
    Wilking, D., Röfer, T.: Realtime Object Recognition Using Decision Tree Learning. In: RoboCup 2004: Robot World Cup VII, pp. 556–563. Springer, Heidelberg (2005)CrossRefGoogle Scholar
  3. 3.
    Heisig, S., Moyle, S.: Using Model Trees to Characterize Computer Resource Usage. In: 1st ACM SIGSOFT Workshop on Self-Managed Systems, pp. 80–84 (2004)Google Scholar
  4. 4.
    Abbes, T., Bouhoula, A., Rusinowitch, M.: Protocol Analysis in Intrusion Detection Using Decision Trees. In: International Conference on Information Technology: Coding and Computing (ITCC 2004), pp. 404–408 (2004)Google Scholar
  5. 5.
    Kang, H., Zhang, Z., Ranjan, S., Nucci, A.: SIP-based VoIP Traffic Behavior Profiling and Its Applications. In: MineNet 2007, pp. 39–44 (2007)Google Scholar
  6. 6.
    Aichernig, B., Peischl, B., Weiglhofer, M., Wotawa, F.: Protocol Conformance Testing a SIP Registrar: an Industrial Application of Formal Methods. In: 5th IEEE Int. Conference on Software Engineering and Formal Methods, pp. 215–224 (2007)Google Scholar
  7. 7.
    Abdelnur, H., State, R., Festor, O.: KiF: A Stateful SIP Fuzzer. In: 1st Int. Conference on Principles, Systems and Applications of IP Telecommunications, (2007)
  8. 8.
    Acharya, A., Wand, X., Wrigth, C., Banerjee, N., Sengupta, B.: Real-time Monitoring of SIP Infrastructure Using Message Classification. In: MineNet 2007, pp. 45–50 (2007)Google Scholar
  9. 9.
    Rosenberg, J., Schulzrinne, H.: Reliability of provisional responses in session initiation protocol (sip). RFC 3262 (June 2002)Google Scholar
  10. 10.
    Rosenberg, J., Schulzrinne, H.: Session initiation protocol (sip): Locating sip servers. RFC 3262 (June 2002)Google Scholar
  11. 11.
    Roach, A.B.: Session initiation protocol (sip)-specific event notification. RFC 3265 (June 2002)Google Scholar
  12. 12.
    Sparks, R.: The session initiation protocol (sip) refer method. RFC 3515 (April 2003)Google Scholar
  13. 13.
    Rosenberg, J.: The session initiation protocol (sip) update method. RFC 3311 (September 2002)Google Scholar
  14. 14.
    Johnston, A., Donovan, S., Sparks, R., Cunningham, C., Summers, K.: Session initiation protocol (sip) basic call flow examples. RFC 3665 (December 2003)Google Scholar
  15. 15.
    Johnston, A., Donovan, S., Sparks, R., Cunningham, C., Summers, K.: Session initiation protocol (sip) public switched telephone network (pstn) call flows. RFC 3666 (Decmember (2003)Google Scholar
  16. 16.
    Marshall, W.: Private session initiation protocol (sip) extensions for media authorization. RFC 3313 (January 2003)Google Scholar
  17. 17.
    Peterson, J.: A privacy mechanism for the session initiation protocol (sip). RFC 3323 (November 2002)Google Scholar
  18. 18.
    Arkko, J., Torvinen, V., Camarillo, G., Niemi, A., Haukka, T.: Security Mechanism Agreement for the Session Initiation Protocol (SIP). RFC 3329 (January 2003)Google Scholar
  19. 19.
    Mitchell, T.: Machine Learning. McGraw-Hill, New York (1997)zbMATHGoogle Scholar
  20. 20.
    Witten, I., Frank, E.: Data Mining: Practical Machine Learning Tools and Techniques. Morgan Kaufmann, San Francisco (2005)zbMATHGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2008

Authors and Affiliations

  • Andrea Hess
    • 1
  • Michael Nussbaumer
    • 1
  • Helmut Hlavacs
    • 1
  • Karin Anna Hummel
    • 1
  1. 1.Department of Distributed and Multimedia SystemsUniversity of ViennaViennaAustria

Personalised recommendations