Leveraging Meaningful Intrusion Detection Mechanism for Voice Traffic Patterns

Authors

• Aizam Nazmien Alinoordin, Multimedia University, Malaysia
• Liana Ameerah Rosli, Multimedia University, Malaysia
• Sin-Ban Ho, Multimedia University, Malaysia
• Said Suleiman Naseer Al Harthy, Modern College of Business and Science, Sultanate of Oman
• Ian Chai, Multimedia University, Malaysia

Corresponding Author ORCID Identifer

Sin-Ban Ho https://orcid.org/0000-0003-2995-2120
Said Suleiman Naseer Al Harthy https://orcid.org/0000-0003-2308-5142

Section

Regular Issue

Abstract

Voice over IP (VoIP) communication has emerged as an important way of communicating as a modern digital medium but it has been facing a lot of cyber threats because of the protocols involved and the real-time aspect associated with it. conventional Intrusion Detection Systems (IDS) do not cope well with VoIP traffic, as signature-based solutions fail to handle various types of intrusions, while anomaly-based approaches tend to produce a high false positive rate. In this research, a hybrid intrusion detection mechanism is integrated, a lightweight and application-based system built around signature matching and anomaly detection to offer advanced protection to VoIP traffic. The system permits traffic analysis offline, based on Packet Capture (PCAP) or Comma Separated Values (CSV) files, as well as active traffic observation, which is provided using two python-based user interfaces, a desktop Tkinter interface and a web interface based on Flask. The predefined Session Initiation Protocol (SIP) or Real-time Transport Protocol (RTP) signature rules namely SIP Flood, RTP Injection, and SIP Brute-force are used as part of hybrid detection engine together with anomaly discovery based on one-class SVM. Other options available are a SIP honeypot listener, email alert notifications and there is a complete logging of incidents. The historical inspection are facilitated by such visualizations as protocol distribution or traffic trend analysis. Through testing, the system is effective in the detection of the VoIP attacks without tuning of the thresholds, and at low false alarm rates. This hybrid IDS demonstrates the feasibility of the signature and anomaly-based detection integration as a way of ensuring VoIP traffic monitoring and as a baseline of any further enhancement with the help of more advanced machine learning or enterprise use.

Cite This Article

Alinoordin, A. N., Rosli, L. A., Ho, S.-B., Al Harthy, S. S. N., & Chai, I. Leveraging Meaningful Intrusion Detection Mechanism for Voice Traffic Patterns. Journal of Informatics and Web Engineering, 5(3), 151–164. https://doi.org/10.33093/jiwe.2026.5.3.9

Creative Commons License

This work is licensed under a Creative Commons Attribution-NonCommercial-No Derivative Works 4.0 International License.