Methods and systems for analyzing network transmission events

1 . A method for analyzing data transmission, the method comprising the steps of:

acquiring at least one transmission message, the transmission message been transmitted over a network according to a predetermined protocol;

providing the at least one acquired transmission message to a state machine;

obtaining, utilizing the state machine, an expected behavior for the at least one acquired transmission message;

comparing the at least one acquired transmission message to the expected behavior;

providing a notification if the comparison indicates departure from the expected behavior.

2 . The method of claim 1 wherein the step of obtaining an expected behavior comprises the step of determining an expected state; and

wherein the step of comparing the at least one acquired transmission message to the expected behavior comprises the step of comparing the behavior at the expected state to the at least one acquired transmission message.

3 . The method of claim 1 wherein the network comprises an Internet Protocol network.

4 . The method of claim 1 wherein the predetermined protocol comprises a signaling protocol.

5 . The method of claim 4 wherein the signaling protocol is a session initiation protocol (SIP).

6 . The method of claim 1 wherein the predetermined protocol comprises a real time transport protocol.

7 . A system comprising:

an acquisition subsystem capable of acquiring at least one message transmitted over a network, said at least one message being transmitted according to a predetermined protocol;

means for instantiating a state machine, said state machine comprising:

means for iterating over a plurality of data messages;

means for providing one data message from the plurality of data messages to an analysis process;

analysis process means for obtaining an expected state for said one data message;

means for comparing said expected state to said one data message; and

means for notifying a difference between said at expected state and said one data message;

means for providing said at least one acquired message to said state machine; and

an output subsystem capable of providing notification of the differences between said at least one acquired message and expected states corresponding to said at least one acquired message.

8 . The system of claim 7 wherein said at least one acquired message comprises a plurality of acquired messages; and

wherein said state machine further comprises means for repeatedly providing each one of the plurality of data messages to said analysis process for processing in parallel.

9 . The system of claim 7 wherein the network comprises an Internet Protocol network.

10 . The system of claim 7 wherein the predetermined protocol comprises a signaling protocol.

11 . The system of claim 10 wherein the signaling protocol is a session initiation protocol (SIP).

12 . The system of claim 7 wherein the predetermined protocol comprises a real time transport protocol.

13 . A computer program product comprising:

at least one computer usable medium having computer readable code embodied therein, the computer readable code capable of causing at least one processor to:

instantiate a state machine for transmission over a network utilizing a predetermined protocol, said state machine comprising:

means for providing at least one data message to an analysis process;

analysis process means for obtaining an expected state for said one data message;

means for comparing said expected state to said at least one data message; and

means for notifying a difference between said at expected state and said at least one data message;

initialize said state machine;

provide at least one acquired transmission message to said state machine;

obtain, utilizing said state machine, an expected behavior for said at least one acquired transmission message;

compare said at least one acquired transmission message to the expected behavior, utilizing said state machine;

provide a notification, utilizing said state machine, if the comparison indicates departure from the expected behavior; and

reset said state machine.

14 . The computer program product of claim 13 wherein said at least one acquired transmission message comprises a plurality of acquired transmission messages;

where in said state machine said at least one data message comprises a plurality of data messages; and

wherein said state machine further comprises:

means for iterating over said plurality of data messages.

15 . The computer program product of claim 13 wherein the network comprises an Internet Protocol network.

16 . The computer program product of claim 13 wherein said predetermined protocol comprises a signaling protocol.

17 . The computer program product of claim 13 wherein the signaling protocol is a session initiation protocol (SIP).

18 . The computer program product of claim 13 wherein said predetermined protocol comprises a real time transport protocol.