Methods, devices and computer readable storage devices for intercepting VoIP traffic for analysis

• US 10,375,126 B2
• Filed: 11/22/2013
• Issued: 08/06/2019
• Est. Priority Date: 11/22/2013
• Status: Expired due to Fees

• Current Assignee: AT&T Mobility II LLC (AT&T, Inc.)
• Original Assignee: AT&T Mobility II LLC (AT&T, Inc.)
• Inventors: Maria, Arturo, Routt, Thomas J.
• Primary Examiner(s): Ferris, Derrick W
• Assistant Examiner(s): Rangel, Manuel
• Application Number:
  US14/087,251
• Publication Number:
  US 20150146540A1
• Time in Patent Office: 2,083 Days
• Field of Search: None
• CPC Class Codes: H04L 51/10 Multimedia information
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications
• CPC Class Codes: H04L 65/1076 Screening of IP real time communications, e.g. spam over Internet telephony [SPIT]
• CPC Class Codes: H04M 3/2281 Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
• CPC Class Codes: H04M 7/006 Networks other than PSTN/ISDN providing telephone service, e.g. Voice over Internet Protocol (VoIP) , including next generation networks with a packet-switched transport layer H04L65/00 takes precedence; aspects not specific to the type of network H04M3/00; special services in those networks H04M3/42
• CPC Class Codes: H04M 7/0078 Security; Fraud detection; Fraud prevention

Abstract

VoIP traffic is intercepted for analysis. Packets transmitted from a mobile communication device over a radio access network to a core mobile communications network are intercepted. VoIP packets are detected within the intercepted packets. The detected VoIP packets are stored for analysis, and the intercepted packets are forwarded to a gateway in communication with a packet data network.

Claims

1. A method, comprising:

intercepting, by executing an instruction with a processor outside a core mobile communications network and not included in a packet data network, packets transmitted from a mobile communication device over a radio access network towards the core mobile communications network and the packet data network, the packets intercepted at an output of the radio access network;

detecting, by executing an instruction with the processor outside the core mobile communications network, voice over internet protocol packets within the intercepted packets;

storing the detected voice over internet protocol packets for analysis;

comparing, by executing an instruction with the processor outside the core mobile communications network, the detected voice over internet protocol packets with a pattern;

determining, by executing an instruction with the processor outside the core mobile communications network, whether the detected voice over internet protocol packets match the pattern based on the comparing;

in response to determining that the detected voice over internet protocol packets match the pattern;

converting, by executing an instruction with the processor outside the core mobile communications network, the detected voice over internet protocol packets into a multimedia message service message as a first alert indicating that the detected voice over internet protocol packets match the pattern;

sending, by executing an instruction with the processor outside the core mobile communications network, the multimedia service message to a multimedia service message gateway; and

converting the detected voice over internet protocol packets into a short message service message as a second alert, the second alert to be transmitted to a short message service gateway; and

forwarding, by executing an instruction with the processor outside the core mobile communications network, the intercepted packets to the gateway of the packet data network to send the intercepted packets towards a destination identified in the voice over internet protocol packets.

2. The method of claim 1, further including sending the detected voice over internet protocol packets to another entity for comparison with a pattern, wherein the other entity determines whether the detected voice over internet protocol packets match the pattern.

3. The method of claim 1, wherein the detecting of the voice over internet protocol packets includes inspecting headers of the intercepted packets.

4. The method of claim 1, further including inspecting the intercepted packets for context.

5. The method of claim 1, further including:

inspecting data fields of the intercepted packets; and

preventing the intercepted packets from being forwarded to the gateway of the packet data network based on results of the inspection.

6. A device, comprising:

a processor outside a core mobile communications network and not included in a packet data network; and

memory including instructions which, when executed by the processor, cause the processor to perform operations including;

intercepting packets transmitted from a mobile communication device over a radio access network towards the core mobile communication network, the packets intercepted at an output of the radio access network;

detecting voice over internet protocol packets within the intercepted packets;

storing the detected voice over internet protocol packets for analysis;

comparing the detected voice over internet protocol packets with a pattern;

determining whether the detected voice over internet protocol packets match the pattern based on the comparing;

in response to determining that the detected voice over internet protocol packets match the pattern;

converting the detected voice over internet protocol packets into a multimedia message service message to be sent as a first alert indicating that the detected voice over internet protocol packets match the pattern; and

sending the multimedia service message to a multimedia service message gateway; and

converting the detected voice over internet protocol packets into a short message service message to be sent as a second alert; and

forwarding the intercepted packets to the gateway of the packet data network to send the intercepted packets towards a destination identified in the voice over internet protocol packets.

7. The device of claim 6, wherein the detecting of the voice over internet protocol packets includes inspecting headers of the intercepted packets.

8. The device of claim 6, wherein the instructions, when executed by the processor, further cause the processor to inspect the intercepted packets for context.

9. A computer readable storage device comprising instructions that, when executed, cause a processor outside a core mobile communications network and not included in a packet data network to perform operations including:

intercepting packets transmitted from a mobile communication device over a radio access network towards the core mobile communication network, the packets intercepted at an output of the radio access network;

detecting voice over internet protocol packets within the intercepted packets;

storing the detected voice over internet protocol packets for analysis;

comparing the detected voice over internet protocol packets with a pattern;

determining whether the detected voice over internet protocol packets match the pattern based on the comparing;

in response to the determining that the detected voice over internet protocol packets match the pattern;

converting the detected voice over internet protocol packets into a multimedia message service message to be sent as a first alert indicating that the detected voice over internet protocol packets match the pattern; and

sending the multimedia service message to a multimedia service message gateway; and

converting the detected voice over internet protocol packets into a short message service message to be sent as a second alert; and

forwarding the intercepted packets of the gateway to the packet data network to send the intercepted packets towards a destination identified in the voice over internet protocol packets.

10. The computer readable storage device of claim 9, wherein the detecting of the voice over internet protocol packets includes inspecting headers of the intercepted packets.

11. The computer readable storage device of claim 9, wherein the instructions, when executed by the processor, further cause the processor to inspect the intercepted packets for context.