A Proposal for Anomaly Traffic Detection in the IP Multimedia Subsystem Using Tanimoto Distance and a Modified Moving Average

The IP Multimedia Subsystem (IMS) supports many kinds of multimedia services and is constantly evolving to meet the growth of mobile services and Internet applications. However, the security specifications of IMS networks do not provide any features to protect the system against Denial of Service (DoS) attacks, so a malicious attack can block the system by congesting a core service of IMS. To address the DoS attack problem, we propose an anomaly-based detection system using the Tanimoto distance to identify deviations in the traffic. We use a modified moving average approach to select a threshold. We also propose using a momentum oscillator to detect a slightly increasing attack. We evaluated the ability of our technique to detect attacks using a comprehensive synthetic data set containing various malicious traffic. Experimental results show that our technique accurately identified attacks and has the flexibility to deal with many types of attack patterns.