Granted Patent B2

US 9,332,026 · App. 14/242,758 · Granted May 3, 2016

Inventors: David Lapsley (North Andover, MA); Miri Mansur (Sugar Land, TX); Jonathan Klotzbach (Cocoa, FL); Ti-yuan Dean Shu (Andover, MA); Sri Chary (Westford, MA); Joby Joseph (Nashua, NH); Mark Topham (Andover, MA); Wassim Matragi (North Andover, MA); Kenneth Dumble (Andover, MA)

Assignee: SONUS NETWORKS, INC.

H04L63/1441H04L63/08

Abstract

Claims (49)

1. A method of operating elements of a communications system to detect and mitigate network attacks in a VoIP network, said elements including a gateway, an analyzer and a guardian module, the method comprising:

receiving, by the gateway, via the VOIP network, an incoming call and associated signaling;

transmitting, from the gateway to the analyzer, a call detail record (CDR) for the incoming call;

maintaining in memory, by the analyzer, a plurality of adaptable profiles that capture statistical and behavioral properties of call detail records (CDRs) associated with a plurality of received calls in the VOIP network;

maintaining in memory, by the analyzer, a plurality of reference profiles that reflect normal call behavior corresponding to the plurality of adaptable profiles;

updating, by the analyzer, an adaptable profile from the plurality of adaptable profiles based on the CDR of the incoming call;

comparing, by the analyzer, the updated adaptable profile with a corresponding reference profile from the plurality of reference profiles;

determining, by the analyzer, if an anomaly indicative of a network attack exists based on the comparing using multivariate analysis; and

when said analyzer determines that an anomaly exists indicative of a network attack:

generating, by the analyzer, an alarm corresponding to the incoming call indicative of the network attack;

transmitting, by the analyzer, to a rules engine, the alarm indicative of the network attack to determine a mitigation action for the incoming call; and

determining by the rules engine one or more mitigation actions for the incoming call, said one or more mitigation actions including a first mitigation action comprising rerouting the incoming call to the guardian module to receive an audio challenge-response test, wherein a complexity level of the test is determined based on the alarm.

2. The method of claim 1 wherein determining if an anomaly exists using multivariate analysis further comprises:

computing a distance between the adaptable profile and the reference profile; and

determining if the difference exceeds a threshold.

3. The method of claim 1 further comprising determining the adaptable profile from the plurality of adaptable profiles, including:

determining a calling number of the incoming call;

locating one or more received calls from the plurality of received calls with the same calling number; and

selecting the adaptable file, created for the one or more received calls, from the plurality of adaptable profiles.

4. The method of claim 1 further including replaying the audio challenge-response test or providing a second audio challenge-response test if a response to the audio challenge-response test is incorrect.

5. The method of claim 4 wherein said one or more mitigation actions includes a third mitigation action, said third mitigation action includes diverting the incoming call to an operator for further investigation when an incorrect answer is received in response to either the replaying of the audio challenge-response test or the playing of the second audio challenge-response test.

6. The method of claim 1 wherein the one or more mitigation actions includes a second mitigation action, said second mitigation action comprising recording the incoming call.

7. The method of claim 1 wherein said guardian module is a network border switch.

8. The method of claim 1 further comprising:

routing the incoming call corresponding to the alarm to a specific location.

9. The method of claim 1 wherein a plurality of said adaptable profiles is updated based on gateway identifications of the corresponding calls.

10. The method of claim 1 further including receiving at the rules engine two types of rules, said first type of rule maps an incoming alarm event to a mitigation action and the second type of rule tracks the impact of a mitigation action and adjusts the mitigation strategy by implementing a different mitigation action when it is determined that previous mitigation action was ineffective.

11. A communications system for detecting and mitigating network attacks in a VoIP network, the communications system comprising:

a gateway configured to: (1) receive via the VOIP network an incoming call and associated signaling and (2) transmit to an analyzer a call detail record (CDR) for the incoming call;

a database for maintaining: i) a plurality of adaptable profiles that capture statistical and behavioral properties of call detail records (CDRs) associated with a plurality of received calls, and ii) a plurality of reference profiles that reflect normal call behavior corresponding to the plurality of adaptable profiles;

a profile unit for updating an adaptable profile from the plurality of adaptable profiles based on a CDR of an incoming call; and

the analyzer further configured to: compare the updated adaptable profile with a corresponding reference profile from the plurality of reference profiles, determine if an anomaly indicative of a network attack exists based on the comparing using multivariate analysis, and

when it is determined that an anomaly indicative of a network attack exists to: generate an alarm corresponding to the incoming call indicative of the network attack and transmit the alarm indicative of a network attack to a rules engine to determine a mitigation action for the incoming call; and

the rules engine being configured to determine one or more mitigation actions for the incoming call, said one or more mitigation actions including a first mitigation action comprising rerouting the incoming call to a guardian module to receive an audio challenge-response test, wherein a complexity level of the test is determined based on the alarm.

12. The communications system of claim 11 wherein said profile unit is further configured to determine the adaptable profile from the plurality of adaptable profiles by:

determining a calling number of the incoming call;

locating one or more received calls from the plurality of received calls with the same calling number; and

selecting the adaptable file, created for the one or more received calls, from the plurality of adaptable profiles.

13. A computer program product stored on a non-transitory computer readable storage medium, for detecting and mitigating network attacks in a VoIP network, the computer program product including instructions being operable to cause data processing apparatus to:

receive an incoming call and associated signaling;

transmit call detail record (CDR) for the incoming call;

maintain in memory a plurality of adaptable profiles that capture statistical and behavioral properties of call detail records (CDRs) associated with a plurality of received calls;

maintain in memory a plurality of reference profiles that reflect normal call behavior corresponding to the plurality of adaptable profiles;

update an adaptable profile from the plurality of adaptable profiles based on a CDR of an incoming call;

compare the updated adaptable profile with a corresponding reference profile from the plurality of reference profiles;

determine if an anomaly indicative of a network attack exists based on the comparing using multivariate analysis; and

when it is determined that an anomaly indicative of a network attack exists to:

generate an alarm corresponding to the incoming call indicative of the network attack and

determine one or mitigation actions for the incoming call, said one or more actions including a first mitigation action comprising rerouting the incoming call to a guardian module to receive an audio challenge-response test, wherein a complexity level of the test is determined based on the alarm.

Assignments (8)

Continuity (3)