Multi-node and multi-call state machine profiling for detecting SPIT
View Patent ↗An apparatus and method for detecting potentially-improper call behavior (e.g., SPIT, etc.) are disclosed. The illustrative embodiment of the present invention is based on finite-state machines (FSMs) that represent the legal states and state transitions of communications protocols at nodes during Voice over Internet Protocol (VoIP) calls. In accordance with the illustrative embodiment, a library of FSM execution profiles associated with improper call behavior and a set of rules (or rule base) associated with improper FSM behavior over one or more calls are maintained. When the behavior of one or more finite-state machines during one or more calls matches either an execution profile in the library or a rule in the rule base, an alert is generated.
1. A method comprising:
determining, by a data-processing system, whether the execution of an instance of a first finite-state machine and an instance of a second finite-state machine during a call matches one or more execution profiles that are associated with improper call behavior,
wherein said instance of said first finite-state machine corresponds to the state of a communications protocol at a first node, and
wherein said instance of said second finite-state machine corresponds to the state of the communications protocol at a second node that is different than the first node, and
wherein at least one of said execution profiles characterizes the execution of a plurality of finite-state machines, corresponding to the respective state of the communications protocol at the respective node, during a call; and
when a match exists, generating, by a data-processing system, a signal that indicates a possible occurrence of improper call behavior,
wherein the execution of a plurality of finite-state machines during a first call matches a first execution profile, and that the execution of said plurality of finite-state machines during a second call matches a second execution profile.
2. The method of claim 1 wherein said improper call behavior is engendered by a third node.
3. The method of claim 1 wherein at least one of said execution profiles comprises a sequence of visited states of a finite-state machine.
4. The method of claim 1 wherein at least one of said execution profiles comprises a metric that is based on how often one or more particular states of a finite-state machine are visited.
5. The method of claim 1 wherein at least one of said execution profiles comprises a metric that is based on how long a finite-state machine spends in one or more particular states.
6. A method comprising:
determining, by a data-processing system, whether the execution of an instance of a first finite-state machine and of an instance of a second finite state machine during a call matches one or more rules that are associated with improper call behavior,
wherein said instance of said first finite-state machine corresponds to the state of a communications protocol at a first node, and
wherein said instance of said second finite-state machine corresponds to the state of the communications protocol at a second node that is different than the first node, and
wherein at least one of said rules comprises a condition pertaining to the execution of a plurality of finite-state machines, corresponding to the respective state of the communications protocol at the respective node, during a call; and
when a match exists, generating, by a data-processing system, a signal that indicates a possible occurrence of improper call behavior,
wherein said condition specifies a relationship between how often said first finite-state machine visits a first non-empty set of states and how often said second finite-state machine visits a second non-empty set of states.
7. The method of claim 6 wherein said improper call behavior is engendered by a third node.
8. The method of claim 6 wherein said first finite-state machine corresponds to the state of a communications protocol at a calling terminal, and wherein said second finite state machine corresponds to the state of said communications protocol at a called terminal.
9. The method of claim 6 wherein said condition specifies a relationship between how long said first finite-state machine spends in a first non-empty set of states and how long said second finite-state machine spends in a second non-empty set of states.
10. A method comprising:
determining, by a data-processing system, whether the execution of an instance of a first finite-state machine and of an instance of a second finite-state machine during a first call and during a second call matches one or more rules that are associated with improper call behavior,
wherein said instance of said first finite-state machine corresponds to the state of a communications protocol at a first node, and
wherein said instance of said second finite-state machine corresponds to the state of the communications protocol at a second node that is different than the first node, and
wherein at least one of said rules comprises a condition pertaining to the execution of a plurality of finite-state machines, corresponding to the respective state of the communications protocol at the respective node, during a plurality of calls; and
when a match exists, generating, by a data-processing system, a signal that indicates a possible occurrence of improper call behavior,
wherein said condition specifies that the execution of a plurality of finite-state machines during a first call matches a first execution profile, and that the execution of said plurality of finite-state machines during a second call matches a second execution profile.
11. The method of claim 10 wherein said condition specifies that the execution of a plurality of finite-state machines during a first call is similar to the execution of said plurality of finite-state machines during a second call.
12. The method of claim 10 wherein said condition specifies that the execution of a plurality of finite-state machines during a first call is different than the execution of said plurality of finite-state machines during a second call.
13. The method of claim 10 wherein said condition specifies that the execution of a plurality of finite-state machines during a first call and during a second call both match a particular execution profile.