Patent ID: 8218534

Claim:
A method of detecting anomaly traffic in Voice over Internet Protocol (VoIP) application, the method comprising the steps of: (A) allowing a router to capture an IP packet of a VoIP flow being transmitted; (B) classifying the captured IP packet into a Session Initiation Protocol (SIP) message and a Real-time Transport Protocol (RTP) traffic; (B) extracting header information from the classified SIP message and RTP traffic; (C) storing the extracted header information in the step (B) in a database; and (D) determining whether SIP-based anomaly traffic or RTP-based anomaly traffic is generated based on the extracted information and the information stored in the database, wherein the step (D) comprises: in the case of RTP traffic, determining that RTP flooding anomaly traffic is generated (i) if RTP traffic having the same 4-tuple as that of the BYE message is searched in the database and Sequence number and Synchronization SourRCe (SSRC) has been changed, (ii) if the sequence number of the first packet of an RTP flow is larger than the sequence number of the last sequence of the RTP flow, the minimum sequence number in the RTP flow is smaller than the sequence number of the first packet or the maximum sequence number in the RTP flow is larger than the sequence number of the last packet, or (iii) if the sequence number of the first packet is smaller than the sequence number of the last packet, the minimum sequence number is larger than the sequence number of the last packet, or the maximum sequence number is smaller than the sequence number of the first packet.