Mass call defense
A system, method, and computer readable medium for mass call defense in a communications network, comprises detecting a mass call event, detecting a resource exhaust event related to the mass call event, where the resource exhaust event is based upon a release message indicating a call connection attempt in excess of a threshold, and releasing, upon detecting the resource exhaust event, subsequent call connection attempts to a called telephone number.
1. A method for mass call defense in a communications network, comprising:
detecting a mass call event comprising a plurality of connection attempts to a suspect station, wherein the suspect station is selected from one or more called stations based on monitoring of one or more call setup messages to each of the called stations, and wherein the suspect station is monitored based on a match criteria;
determining a source of the mass call event;
detecting a resource exhaust event of a destination element of the communications network;
correlating the resource exhaust event to the mass call event; and
releasing one or more subsequent call connection attempts between the source and the destination element.
2. The method of claim 1 wherein the mass call event indicates the call attempt to the destination element in excess of a threshold.
3. The method of claim 1 comprising releasing, upon detecting the resource exhaust event, subsequent call connection attempts from a calling telephone number, wherein the mass call event indicates the call attempt from the calling telephone number in excess of a threshold.
4. The method of claim 1 wherein the resource exhaust event is based upon a release message of the call connection attempt to the destination element.
5. The method of claim 1 wherein the resource exhaust event is based upon detection of a flow of release messages.
6. The method of claim 1 wherein the resource exhaust event is a circuit exhaust event indicating no circuits are available to complete the call connection attempt.
7. The method of claim 6 wherein the circuit exhaust event is detected from a release message from the destination element.
8. The method of claim 1 comprising sending a message to a user indicating that the resource exhaust event has occurred.
9. The method of claim 1 wherein detecting the resource exhaust event is based upon the detecting of the mass call event.
10. The method of claim 1 wherein releasing subsequent call connection attempts to the destination element is based upon the detecting of the mass call event.
11. The method of claim 1 wherein releasing subsequent call connection attempts from the source is based upon the detecting of the mass call event.
12. A computer readable medium comprising computer executable instructions for:
detecting a mass call event comprising a plurality of connection attempts to a suspect station, wherein the suspect station is selected from one or more called stations based on monitoring of one or more call setup messages to each of the called stations, and wherein the suspect station is monitored based on a match criteria;
determining a source of the mass call event;
detecting a resource exhaust event related to the mass call event via a resource exhaust event detector;
and releasing one or more subsequent call connection attempts between the source and the destination element.
13. The computer readable medium of claim 12 comprising instructions for releasing, upon detecting the resource exhaust event, subsequent call connection attempts in excess of a user defined mass call event threshold.
14. The computer readable medium of claim 12 , wherein the mass call event indicates at least one of: the call attempt to a called switch in excess of a threshold; the call attempt to the called switch from a calling number in excess of a threshold; and the call attempt to the called switch from a calling switch in excess of a threshold.
15. The computer readable medium of claim 12 wherein the resource exhaust event is based upon a release message of the call connection attempt to the called telephone number or called switch.
16. The computer readable medium of claim 12 wherein the resource exhaust event is based upon detection of a flow of the release messages.
17. A system that provides mass call defense, comprising:
a processor,
a resource exhaust event detector that is configured to detect a resource exhaust event at a destination element; and
a memory communicably coupled to the processor, wherein the memory stores the detected mass call event, the mass call event threshold and the resource exhaust event;
wherein the processor detects a mass call event comprising a plurality of connection attempts to a suspect station, wherein the suspect station is selected from one or more called stations based on monitoring of one or more call setup messages to each of the called stations, and wherein the suspect station is monitored based on a match criteria;
wherein the processor determines a source of the mass call event; and
wherein the processor causes one or more call connection attempts between the source and the destination element to be released during the mass call event.
18. The system of claim 17 wherein the processor releases, upon detecting the resource exhaust event, subsequent call connection attempts in excess of a mass call event threshold.
19. The system of claim 17 wherein the processor releases, upon detecting the resource exhaust event, subsequent call connection attempts from a calling telephone number in excess of a mass call event threshold.
20. The system of claim 17 wherein the processor sends a message indicating that the resource exhaust event has occurred.