State Machine Profiling for Voice Over IP Calls

• US 20090274143A1
• Filed: 05/05/2008
• Published: 11/05/2009
• Est. Priority Date: 09/12/2007
• Status: Active Grant

• Current Assignee: Arlington Technologies, LLC (Dominion Harbor Enterprises, LLC)
• Original Assignee: Avaya Incorporated
• Inventors: Singh, Navjot, Adhikari, Akshay, Garg, Sachin, Wu, Yu-Sung
• Granted Patent: US 9,438,641 B2
• Time in Patent Office: Days
• US Class Current: 370/352
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 65/1079 of unsolicited session attempts, e.g. SPIT
• CPC Class Codes: H04M 2201/18 Comparators
• CPC Class Codes: H04M 3/436 Arrangements for screening incoming calls , i.e. evaluating the characteristics of a call before deciding whether to answer it based on the calling party profile H04M3/42059; based on location H04M3/42348; based on presence H04M3/42365; diversion H04M3/54

Abstract

An apparatus and method for detecting potentially-improper call behavior (e.g., SPIT, etc.) are disclosed. The illustrative embodiment of the present invention is based on finite-state machines (FSMs) that represent the legal states and state transitions of a communications protocol at a node during a Voice over Internet Protocol (VoIP) call. In accordance with the illustrative embodiment, a library of FSM execution profiles associated with improper call behavior is maintained. When there is a match between the behavior of a finite-state machine during a call and an execution profile in the library, an alert is generated.

Claims

1. A method comprising:

determining whether the execution of an instance of a finite-state machine during a call matches one or more execution profiles that are associated with improper call behavior, wherein said instance of said finite-state machine state corresponds to the state of a communications protocol at a node; and

when a match exists, generating a signal that indicates a possible occurrence of improper call behavior.

2. The method of claim 1 wherein said improper call behavior is SPIT.

3. The method of claim 1 wherein said node is a first telecommunications terminal, and wherein said improper call behavior is engendered by a second telecommunications terminal.

4. The method of claim 1 wherein at least one of said execution profiles comprises a sequence of visited states of said finite-state machine.

5. The method of claim 1 wherein at least one of said execution profiles comprises a metric that is based on how often one or more particular states of said finite-state machine are visited.

6. The method of claim 1 wherein at least one of said execution profiles comprises a metric that is based on how long said finite-state machine spends in one or more particular states.

7. The method of claim 1 wherein said call is a Voice over Internet Protocol call, and wherein said communications protocol is one of Session Initiation Protocol and Real-time Transport Protocol.

8. A data store comprising a plurality of execution profiles of a finite-state machine, wherein said finite-state machine corresponds to the state of a communications protocol at a node, and wherein at least one of said execution profiles is associated with improper call behavior.

9. The method of claim 8 wherein said improper call behavior is SPIT.

10. The method of claim 8 wherein at least one of said execution profiles comprises a sequence of visited states of said finite-state machine.

11. The method of claim 8 wherein at least one of said execution profiles comprises a metric that is based on how often one or more particular states of said finite-state machine are visited.

12. The method of claim 8 wherein at least one of said execution profiles comprises a metric that is based on how long said finite-state machine spends in one or more particular states.

13. The method of claim 8 wherein said call is a Voice over Internet Protocol call, and wherein said communications protocol is one of Session Initiation Protocol and Real-time Transport Protocol.

14. A method comprising generating one or more execution profiles of a finite-state machine, wherein said finite-state machine corresponds to the state of a communications protocol at a node, and wherein at least one of said execution profiles is associated with improper call behavior.

15. The method of claim 14 wherein at least one of said execution profiles is based on empirical data for one or more prior calls.

16. The method of claim 14 further comprising building a data store that comprises said one or more execution profiles and is for matching against the execution of an instance of said finite-state machine during a call.

17. The method of claim 14 wherein said improper call behavior is SPIT.

18. The method of claim 14 wherein at least one of said execution profiles comprises a sequence of visited states of said finite-state machine.

19. The method of claim 14 wherein at least one of said execution profiles comprises a metric that is based on how often one or more particular states of said finite-state machine are visited.

20. The method of claim 14 wherein at least one of said execution profiles comprises a metric that is based on how long said finite-state machine spends in one or more particular states.