DETECTION AND METHODS FOR HANDLING A TDOS ATTACK

1 . A method, comprising:

receiving a first call;

identifying a first telephone number associated with the first call;

receiving a second call;

identifying a second telephone number associated with the second call;

determining to banish the second call, at least in part based the second telephone number and a determination that a number of calls associated with the first telephone number exceeds a predetermined threshold; and

banishing the second call.

2 . The method of claim 1 , wherein the first telephone number is a call back number for the first call, and the second telephone number is a call back number for the second call.

3 . The method of claim 2 , further comprising:

recording a first ingress trunk group of the first call, at least in part based on the determination that the number of calls associated with the first telephone number exceeds the predetermined threshold; and

determining whether the first telephone number matches the second telephone number, at least in part based on the first ingress trunk group and a second ingress trunk group of the second call.

4 . The method of claim 1 , wherein the determining to banish the second call is performed at least in part based on the determination that the number of calls associated with the first telephone number exceeds the predetermined threshold.

5 . The method of claim 1 , wherein the first telephone number is a pseudo Automatic Number Identification (pANI) number, a call back number, a pilot telephone number, or an Automatic Location and Information (ALI) location telephone number.

6 . The method of claim 1 , further comprising:

interrogating the second call, at least in part based on a determination that a telephone number associated with the first call or the second call has been banished more than a predetermined number of times.

7 . The method of claim 1 , further comprising:

ending the second call, at least in part based on a determination that a number of interrogations exceeds a predetermined threshold.

8 . An apparatus, comprising:

a network interface that receives a first call and a second call; and

a processor configured to identify a first telephone number associated with the first call, to identify a second telephone number associated with the second call, and to determine to banish the second call, at least in part based the second telephone number and a determination that a number of calls associated with the first telephone number exceeds a predetermined threshold, wherein the second call is banished.

9 . The apparatus of claim 8 , wherein the first telephone number is a call back number for the first call, and the second telephone number is a call back number for the second call.

10 . The apparatus of claim 9 , wherein the processor is further configured to record a first ingress trunk group of the first call, at least in part based on the determination that the number of calls associated with the first telephone number exceeds the predetermined threshold, and the processor is further configured to determine whether the first telephone number matches the second telephone number, at least in part based on the first ingress trunk group and a second ingress trunk group of the second call.

11 . The apparatus of claim 8 , wherein the processor is further configured to determine to banish the second call at least in part based on the determination that the number of calls associated with the first telephone number exceeds the predetermined threshold.

12 . The apparatus of claim 8 , wherein the first telephone number is a pseudo Automatic Number Identification (pANI) number, a call back number, a pilot telephone number, or an Automatic Location and Information (ALI) location telephone number.

13 . The apparatus of claim 8 , wherein the second call is interrogated, at least in part based on a determination that a telephone number associated with the first call or the second call has been banished more than a predetermined number of times.

14 . The apparatus of claim 8 , wherein the second call is ended, at least in part based on a determination that a number of interrogations exceeds a predetermined threshold.

15 . A computer-readable medium including instructions that, when executed by a processor, perform operations comprising:

receiving a first call;

identifying a first telephone number associated with the first call;

receiving a second call;

identifying a second telephone number associated with the second call; and

determining to banish the second call, at least in part based the second telephone number and a determination that a number of calls associated with the first telephone number exceeds a predetermined threshold, wherein the second call is banished.

16 . The medium of claim 15 , wherein the first telephone number is a call back number for the first call, and the second telephone number is a call back number for the second call.

17 . The medium of claim 16 , the operations further comprising:

recording a first ingress trunk group of the first call, at least in part based on the determination that the number of calls associated with the first telephone number exceeds the predetermined threshold; and

determining whether the first telephone number matches the second telephone number, at least in part based on the first ingress trunk group and a second ingress trunk group of the second call.

18 . The medium of claim 15 , wherein the determining to banish the second call is performed at least in part based on the determination that the number of calls associated with the first telephone number exceeds the predetermined threshold.

19 . The medium of claim 15 , wherein the second call is interrogated, at least in part based on a determination that a telephone number associated with the first call or the second call has been banished more than a predetermined number of times.

20 . The medium of claim 15 , the operations further comprising:

ending the second call, at least in part based on a determination that a number of interrogations exceeds a predetermined threshold.