State machine profiling for voice over IP calls
First Claim
Patent Images
1. A method comprising:
- generating, by a data-processing system, one or more execution profiles of a finite-state machine;
generating, by the data-processing system, one or more rules that characterize a relationship among the execution of multiple finite-state machines or among one or more finite-state machines across a plurality of calls, wherein a rule in the one or more rules comprises one or more of an identity of a caller, an identity of a called party, and a calling time;
building, by the data-processing system, a data store that comprises the one or more execution profiles and is for matching against an execution of an instance of the finite-state machine during a call; and
building, by the data-processing system, a data store that comprises the one or more rules and is for matching against the execution of the multiple finite-state machines or against the one or more finite-state machines across the plurality of calls;
wherein the finite-state machine corresponds to a state of a communications protocol at a node, wherein at least one of the execution profiles is associated with improper call behavior,wherein the execution profiles associated with improper call behavior comprise one or more of an identity of a caller, an identity of a called party, a and calling time,wherein at least one of the execution profiles comprises a metric that is based on how often the finite-state machine visits one or more particular states; and
wherein at least one of the execution profiles comprises a metric that is based on how long the finite-state machine spends in one or more particular states.
25 Assignments
0 Petitions
Accused Products
Abstract
An apparatus and method for detecting potentially-improper call behavior (e.g., SPIT, etc.) are disclosed. The illustrative embodiment of the present invention is based on finite-state machines (FSMs) that represent the legal states and state transitions of a communications protocol at a node during a Voice over Internet Protocol (VoIP) call. In accordance with the illustrative embodiment, a library of FSM execution profiles associated with improper call behavior is maintained. When there is a match between the behavior of a finite-state machine during a call and an execution profile in the library, an alert is generated.
60 Citations
19 Claims
-
1. A method comprising:
-
generating, by a data-processing system, one or more execution profiles of a finite-state machine; generating, by the data-processing system, one or more rules that characterize a relationship among the execution of multiple finite-state machines or among one or more finite-state machines across a plurality of calls, wherein a rule in the one or more rules comprises one or more of an identity of a caller, an identity of a called party, and a calling time; building, by the data-processing system, a data store that comprises the one or more execution profiles and is for matching against an execution of an instance of the finite-state machine during a call; and building, by the data-processing system, a data store that comprises the one or more rules and is for matching against the execution of the multiple finite-state machines or against the one or more finite-state machines across the plurality of calls; wherein the finite-state machine corresponds to a state of a communications protocol at a node, wherein at least one of the execution profiles is associated with improper call behavior, wherein the execution profiles associated with improper call behavior comprise one or more of an identity of a caller, an identity of a called party, a and calling time, wherein at least one of the execution profiles comprises a metric that is based on how often the finite-state machine visits one or more particular states; and wherein at least one of the execution profiles comprises a metric that is based on how long the finite-state machine spends in one or more particular states. - View Dependent Claims (2, 3, 4, 5)
-
-
6. A method comprising:
-
receiving, by a server of a call-monitoring system, a notification related to a behavior of a finite-state machine during a call, wherein the finite-state machine corresponds to a state of a communications protocol at a node and wherein the behavior comprises at least one state transition of the communications protocol at the node; comparing, by the server of the call-monitoring system, the behavior of the finite-state machine to a plurality of execution profiles, wherein one or more of the execution profiles comprise one or more of an identity of a caller, an identity of a called party, and a calling time; when the behavior of the finite-state machine matches at least one of the plurality of execution profiles, generating, by the server of the call-monitoring system, a first signal that indicates a first possible occurrence of improper call behavior; and when the behavior of the finite-state machine does not match at least one of the plurality of execution profiles; comparing, by the server of the call-monitoring system, the behavior of the finite-state machine to a plurality of rules, wherein one or more of the rules comprise one or more of an identity of a caller, an identity of a called party, and a calling time; and generating, by the server of the call-monitoring system, a second signal that indicates a second possible occurrence of improper call behavior when the behavior of the finite state machine matches at least one of the plurality of rules. - View Dependent Claims (7, 8, 9, 10, 11, 12)
-
-
13. A call-monitoring system comprising:
-
a server comprising a processor coupled to a memory, wherein the processor executes program code stored in the memory to; receive a notification related to a behavior of a finite-state machine during a call, wherein the finite-state machine corresponds to a state of a communications protocol at a node and wherein the behavior comprises at least one state transition of the communications protocol at the finite-state machine; compare the behavior of the finite-state machine to a plurality of execution profiles, wherein one or more of the execution profiles comprise one or more of an identity of a caller, an identity of a called party, and a calling time; when the behavior of the finite-state machine matches at least one of the plurality of execution profiles, generate a first signal that indicates a first possible occurrence of improper call behavior; and when the behavior of the finite-state machine does not match at least one of the plurality of execution profiles; compare the behavior of the finite-state machine to a plurality of rules, wherein one or more of the rules comprise one or more of an identity of a caller, an identity of a called party, and a calling time; and generate a second signal that indicates a second possible occurrence of improper call behavior when the behavior of the finite state machine matches at least one of the plurality of rules. - View Dependent Claims (14, 15, 16, 17, 18, 19)
-
Specification