State machine profiling for voice over IP calls
An apparatus and method for detecting potentially-improper call behavior (e.g., SPIT, etc.) are disclosed. The illustrative embodiment of the present invention is based on finite-state machines (FSMs) that represent the legal states and state transitions of a communications protocol at a node during a Voice over Internet Protocol (VoIP) call. In accordance with the illustrative embodiment, a library of FSM execution profiles associated with improper call behavior is maintained. When there is a match between the behavior of a finite-state machine during a call and an execution profile in the library, an alert is generated.
1. A method comprising:
generating, by a data-processing system, one or more execution profiles of a finite-state machine;
generating, by the data-processing system, one or more rules that characterize a relationship among the execution of multiple finite-state machines or among one or more finite-state machines across a plurality of calls, wherein a rule in the one or more rules comprises one or more of an identity of a caller, an identity of a called party, and a calling time;
building, by the data-processing system, a data store that comprises the one or more execution profiles and is for matching against an execution of an instance of the finite-state machine during a call; and
building, by the data-processing system, a data store that comprises the one or more rules and is for matching against the execution of the multiple finite-state machines or against the one or more finite-state machines across the plurality of calls;
wherein the finite-state machine corresponds to a state of a communications protocol at a node, wherein at least one of the execution profiles is associated with improper call behavior,
wherein the execution profiles associated with improper call behavior comprise one or more of an identity of a caller, an identity of a called party, a and calling time,
wherein at least one of the execution profiles comprises a metric that is based on how often the finite-state machine visits one or more particular states; and
wherein at least one of the execution profiles comprises a metric that is based on how long the finite-state machine spends in one or more particular states.
2. The method of claim 1 wherein at least one of the execution profiles is based on empirical data for one or more prior calls.
3. The method of claim 1 , wherein the improper call behavior is Spam over Internet Telephony.
4. The method of claim 1 , wherein at least one of the execution profiles comprises a sequence of visited states of the finite-state machine.
5. The method of claim 1 , wherein the call is a Voice over Internet Protocol call, and wherein the communications protocol is one of Session Initiation Protocol and Real-time Transport Protocol.
6. A method comprising:
receiving, by a server of a call-monitoring system, a notification related to a behavior of a finite-state machine during a call, wherein the finite-state machine corresponds to a state of a communications protocol at a node and wherein the behavior comprises at least one state transition of the communications protocol at the node;
comparing, by the server of the call-monitoring system, the behavior of the finite-state machine to a plurality of execution profiles, wherein one or more of the execution profiles comprise one or more of an identity of a caller, an identity of a called party, and a calling time;
when the behavior of the finite-state machine matches at least one of the plurality of execution profiles, generating, by the server of the call-monitoring system, a first signal that indicates a first possible occurrence of improper call behavior; and
when the behavior of the finite-state machine does not match at least one of the plurality of execution profiles:
comparing, by the server of the call-monitoring system, the behavior of the finite-state machine to a plurality of rules, wherein one or more of the rules comprise one or more of an identity of a caller, an identity of a called party, and a calling time; and
generating, by the server of the call-monitoring system, a second signal that indicates a second possible occurrence of improper call behavior when the behavior of the finite state machine matches at least one of the plurality of rules.
7. The method of claim 6 , wherein the improper call behavior is Spam over Internet Telephony.
8. The method of claim 6 , wherein the node is a first telecommunications terminal, and wherein the improper call behavior is engendered by a second telecommunications terminal.
9. The method of claim 6 , wherein the call is a Voice over Internet Protocol call, and wherein the communications protocol is one of Session Initiation Protocol and Real-time Transport Protocol.
10. The method of claim 6 , wherein at least one of the execution profiles comprises a sequence of visited states of the finite-state machine.
11. The method of claim 6 , wherein at least one of the execution profiles comprises a metric that is based on how often the finite-state machine visits one or more particular states.
12. The method of claim 6 , wherein at least one of the execution profiles comprises a metric that is based on how long the finite-state machine spends in one or more particular states.
13. A call-monitoring system comprising:
a server comprising a processor coupled to a memory, wherein the processor executes program code stored in the memory to:
receive a notification related to a behavior of a finite-state machine during a call, wherein the finite-state machine corresponds to a state of a communications protocol at a node and wherein the behavior comprises at least one state transition of the communications protocol at the finite-state machine;
compare the behavior of the finite-state machine to a plurality of execution profiles, wherein one or more of the execution profiles comprise one or more of an identity of a caller, an identity of a called party, and a calling time;
when the behavior of the finite-state machine matches at least one of the plurality of execution profiles, generate a first signal that indicates a first possible occurrence of improper call behavior; and
when the behavior of the finite-state machine does not match at least one of the plurality of execution profiles:
compare the behavior of the finite-state machine to a plurality of rules, wherein one or more of the rules comprise one or more of an identity of a caller, an identity of a called party, and a calling time; and
generate a second signal that indicates a second possible occurrence of improper call behavior when the behavior of the finite state machine matches at least one of the plurality of rules.
14. The call-monitoring system of claim 13 , wherein the improper call behavior is Spam over Internet Telephony.
15. The call-monitoring system of claim 13 , wherein the node is a first telecommunications terminal, and wherein the improper call behavior is engendered by a second telecommunications terminal.
16. The call-monitoring system of claim 13 , wherein the call is a Voice over Internet Protocol call, and wherein the communications protocol is one of Session Initiation Protocol and Real-time Transport Protocol.
17. The call-monitoring system of claim 13 , wherein at least one of the execution profiles comprises a sequence of visited states of the finite-state machine.
18. The call-monitoring system of claim 13 , wherein at least one of the execution profiles comprises a metric that is based on how often the finite-state machine visits one or more particular states.
19. The call-monitoring system of claim 13 , wherein at least one of the execution profiles comprises a metric that is based on how long the finite-state machine spends in one or more particular states.