Maliciouis user agent detection and denial of service (DOS) detection and prevention using fingerprinting

1. A method comprising:

receiving a session control protocol request message;

determining whether the session control protocol request message is associated with an ongoing session control dialog or an ongoing session control transaction;

fingerprinting the session control protocol request message, to generate a fingerprint, in response to a determination that the session control protocol request message is not associated with an ongoing session control dialog or an ongoing session control transaction;

comparing the fingerprint to a list of fingerprints associated with known malicious user agents when the received session control protocol request message is not associated with an ongoing session control dialog or an ongoing session control transaction; and

rejecting the session control protocol request message when the fingerprint matches any fingerprint in the list of fingerprints associated with known malicious user agents.

2. The method of claim 1 ,

wherein the session control protocol request message includes a Session Initiation Protocol (SIP) request message having a header,

wherein fingerprinting the session control protocol request message includes fingerprinting the header of the SIP request message; and

wherein determining whether the session control protocol request message is associated with an ongoing session control dialog or an ongoing session control transaction includes determining a dialog identifier (ID) or a transaction ID associated with the SIP request message.

3. The method of claim 2 , wherein fingerprinting the header includes fingerprinting the header based on a number of header elements, a content of header elements, or an ordering of header elements.

4. The method of claim 2 ,

wherein fingerprinting the header includes generating a first fingerprint by fingerprinting a Call-ID field in the header, and

wherein comparing includes comparing the first fingerprint to the list of fingerprints when the received session control protocol request message is not associated with an ongoing session control dialog or an ongoing session control transaction, and

wherein the method further comprises:

generating a second fingerprint, in response to the first fingerprint not matching any fingerprint in the list of fingerprints, by fingerprinting the header of the SIP request message based on a number of header elements, a content of header elements, or an ordering of header elements;

comparing, in response to the first fingerprint not matching any fingerprint in the list of fingerprints, the second fingerprint to the list of fingerprints when the received session control protocol request message is not associated with an ongoing session control dialog or an ongoing session control transaction; and

rejecting the session control protocol request message when the second fingerprint matches any fingerprint in the list of fingerprints.

5. The method of claim 2 , further comprising:

comparing the fingerprint to a list of fingerprints associated with known non-malicious user agents; and

accepting the session control protocol request message when the fingerprint matches any fingerprint in the list of fingerprints associated with known non-malicious user agents.

6. The method of claim 5 , further comprising:

determining whether the received session control protocol request message is associated with an anomalous event when the fingerprint does not match any fingerprint in the list of fingerprints associated with known malicious user agents and when the fingerprint does not match any fingerprints in the list of fingerprints associated with known non-malicious user agents; and

adding the fingerprint to the list of fingerprints associated with known malicious user agents when determined that the received session control protocol request message is associated with an anomalous event.

7. The method of claim 5 , further comprising:

determining whether the received session control protocol request message is associated with an anomalous event when the fingerprint does not match any fingerprint in the list of fingerprints associated with known malicious user agents and when the fingerprint does not match any fingerprint in the list of fingerprints associated with known non-malicious user agents; and

adding the fingerprint to the list of fingerprints associated with known non-malicious user agents when determined that the received session control protocol request message is not associated with an anomalous event.

8. A method comprising:

receiving a session control protocol request message;

determining whether the session control protocol request message is associated with an ongoing session control dialog or an ongoing session control transaction;

fingerprinting the session control protocol message, to generate a fingerprint, in response to a determination that the session control protocol message is not associated with an ongoing session control dialog or an ongoing session control transaction;

comparing the fingerprint to a list of fingerprints associated with known malicious user agents when the session control protocol request message is not associated with an ongoing session control dialog or an ongoing session control transaction;

holding the session control protocol request message when the fingerprint does not match any fingerprint in the list of fingerprints associated with known malicious user agents;

determining whether the received session control protocol request message is associated with an anomalous event when the fingerprint does not match any fingerprint in the list of fingerprints associated with known malicious user agents; and

blocking the received session control protocol request message when the received session control protocol request message is associated with the anomalous event.

9. The method of claim 8 , wherein the session control protocol request message is a particular request message, and wherein determining whether the particular request message is associated with the anomalous event includes:

receiving a number of additional session control protocol messages;

fingerprinting each of the additional session control protocol messages to generate a fingerprint for each of the additional session control protocol messages, wherein the fingerprint of each of the additional session control protocol messages matches the particular request message; and

determining that the particular request message is associated with the anomalous event when the number of additional session control protocol messages exceeds a threshold.

10. The method of claim 8 , further comprising:

adding the fingerprint to the list of fingerprints associated with known malicious user agents when determined that the received session control protocol request message is associated with an anomalous event.

11. The method of claim 8 ,

wherein the session control protocol request message includes a Session Initiation Protocol (SIP) request message having a header, and

wherein fingerprinting the session control protocol message includes fingerprinting the header of the SIP request message.

12. The method of claim 11 , wherein fingerprinting the header includes fingerprinting the header based on a number of header elements, a content of header elements, or an ordering of header elements.

13. The method of claim 12 , wherein fingerprinting the header includes fingerprinting a Call-ID field in the header.

14. The method of claim 12 , further comprising:

comparing the fingerprint to a list of fingerprints associated with known non-malicious user agents; and

accepting the session control protocol request message when the fingerprint matches any fingerprint in the list of fingerprints associated with known non-malicious user agents.

15. The method of claim 12 , further comprising:

determining whether the received session control protocol request message is associated with an anomalous event when the fingerprint does not match any fingerprint in the list of fingerprints associated with known malicious user agents and when the fingerprint does not match any fingerprint in the list of fingerprints associated with known non-malicious user agents; and

adding the fingerprint to the list of fingerprints associated with known non-malicious user agents when the received session control protocol request message is not associated with an anomalous event.

16. A network device comprising:

a receiver to receive a session control protocol request message;

a memory to store a list of fingerprints associated with known malicious user agents; and

a processor to:

determine whether the session control protocol request message is associated with an ongoing session control dialog or an ongoing session control transaction,

fingerprint the session control protocol message in response to a determination or an ongoing session control transaction,

compare the fingerprint to a list of fingerprints associated with known malicious user agents when the session control protocol request message is not associated with an ongoing session control dialog or an ongoing session control transaction, and

determine to reject the request message when the fingerprint matches any fingerprint in the list of fingerprints associated with known malicious user agents.

17. The network device of claim 16 ,

wherein the session control protocol request message includes a Session Initiation Protocol (SIP) request message having a header, and

wherein the processor is configured to fingerprint the session control protocol message by fingerprinting the header of the SIP request message.

18. The network device of claim 17 , wherein the processor is configured to fingerprint the header based on a number of header elements, a content of header elements, or an ordering of header elements.

19. The network device of claim 17 , wherein the processor is configured to fingerprint a Call-ID field in the header.

20. The network device of claim 17 , wherein the processor is configured to:

compare the fingerprint to a list of fingerprints associated with known non-malicious user agents; and

determine to accept the session control protocol request message when the fingerprint matches any fingerprint in the list of fingerprints associated with known non-malicious user agents.

21. The network device of claim 20 , wherein the processor is further configured to:

determine whether the received session control protocol request message is associated with an anomalous event when the fingerprint does not match any fingerprint in the list of fingerprints associated with known malicious user agents and when the fingerprint does not match any fingerprints in the list of fingerprints associated with known non-malicious user agents; and

add the fingerprint to the list of fingerprints associated with known malicious user agents when the received session control protocol request message is associated with an anomalous event.

22. The network device of claim 20 , further comprising:

determining whether the received session control protocol request message is associated with an anomalous event when the fingerprint does not match any fingerprint in the list of fingerprints associated with known malicious user agents and when the fingerprint does not match any fingerprint in the list of fingerprints associated with known non-malicious user agents; and

adding the fingerprint to the list of fingerprints associated with known non-malicious user agents when the received session control protocol request message is not associated with an anomalous event.

23. The method of claim 1 , further comprising:

receiving an additional session control protocol request message;

determining whether the additional session control protocol request message is associated with an ongoing session control dialog or an ongoing session control transaction; and

forwarding the additional session control protocol request message to a proxy network device, without comparing a fingerprint of the additional session control protocol request message to the list of fingerprints, in response to a determination that the additional session control protocol request message is associated with an ongoing session control dialog or an ongoing session control transaction.