Register flooding attacks detection in IP multimedia subsystems by using adaptive z-score CUSUM algorithm

IP Multimedia Subsystems (IMS) is the core of Next Generation Network (NGN) which provides high quality combination of different multimedia services. Although IMS open core architecture has made it an easy access network for clients, it has result in some security weaknesses and vulnerabilities, by which attacks and threats try to enter network. Denial of service attacks (DoS), prevent legitimate users from using services by overloading network resources. These attacks are usually based on sending flooding packets by spoofed IP addresses and are called Distributed Denial of Service (DDoS), these attacks can be generated through REGISTER messages that are followed by heavy weighted process of registration in Call Session Control Function (CSCF) entities. In this paper an adaptive CUSUM algorithm is proposed which can differ peak time traffic from attack traffic and detect flooding attacks with low values of False Alarm Rates (FAR) and of Detection Delays (DD) and Detection Time (DT).