Avaya Inc.

Avaya Technology LLC

Akshay Adhikari

Navjot Singh

Sachin Garg

Anjur Sundaresan Krishnakumar

Jean Meloche

Lorraine Denby

Yu-Sung Wu

Balaji Sathyanarayana Rao

Colin Lingwood Mallows

Amit Agarwal

Neil Hepworth

Karen Barrett

John R Tuck, Jr

Russell C Jones

Scott Vincent Bianco

Anupam Rai

Shane M Sullivan

Yehuda Vardi

Rod D Livingood

Wayne Sam

An apparatus and method are disclosed for detecting intrusions in Voice over Internet Protocol systems, without the use of an attack signature database. In particular, the illustrative embodiment is based on the observation that some VoIP-related protocols (e.g., the Session Initiation Protocol [SIP], etc.) are simple enough to be represented by a finite-state machine (FSM) of compact size. A finite-state machine is maintained for each session/node/protocol combination, and any illegal state or state transition&#x2014;which might be the result of a malicious attack&#x2014;is flagged as a potential intrusion.

Signature-free intrusion detection

An apparatus and method for detecting potentially-improper call behavior (e.g., SPIT, etc.) are disclosed. The illustrative embodiment of the present invention is based on finite-state machines (FSMs) that represent the legal states and state transitions of a communications protocol at a node during a Voice over Internet Protocol (VoIP) call. In accordance with the illustrative embodiment, a library of FSM execution profiles associated with improper call behavior is maintained. When there is a match between the behavior of a finite-state machine during a call and an execution profile in the library, an alert is generated.

State machine profiling for voice over IP calls

An apparatus and method for detecting intrusions in Voice over Internet Protocol systems with distributed stateful intrusion detection. When a Session Initiation Protocol (SIP) signal is received as an application-layer protocol signal, the received application-layer protocol signal is distributed to a first finite-state machine and to a second finite-state machine. A data processing system detects that the application-layer protocol enters a first application-layer protocol state S1 at a first node at a first time, determines whether the application-layer protocol fails to enter a second application-layer protocol state S2 at a second node within &#x3b4; seconds, a positive real number, and generates a signal that indicates a potential intrusion in response to the determination.

Distributed stateful intrusion detection for voice over IP

An apparatus and method for detecting potentially-improper call behavior (e.g., SPIT, etc.) are disclosed. The illustrative embodiment of the present invention is based on finite-state machines (FSMs) that represent the legal states and state transitions of communications protocols at nodes during Voice over Internet Protocol (VoIP) calls. In accordance with the illustrative embodiment, a library of FSM execution profiles associated with improper call behavior and a set of rules (or rule base) associated with improper FSM behavior over one or more calls are maintained. When the behavior of one or more finite-state machines during one or more calls matches either an execution profile in the library or a rule in the rule base, an alert is generated.

Multi-node and multi-call state machine profiling for detecting SPIT

A method is disclosed that enables mitigating at least some of the problems caused by a packet attack. When a first Internet Protocol (IP)-capable device is subjected to a packet attack, it indicates periodically to a second IP-capable device that certain communications with the first device are to be suspended. The periodic transmitting of the indication is performed at a slower rate than the keep-alive mechanism that is normally used to detect loss of connectivity. When the second device receives the transmitted indication, it refrains from transmitting keep-alive messages to the first device for a predetermined interval. Meanwhile, the first device also refrains from transmitting keep-alive messages to the second device for a similar interval. In transmitting the suspend indication, the illustrative embodiment seeks to prevent pairs of communicating devices that are experiencing packet attacks from continuing their operation under the erroneous assumption that each device is unavailable.

Maintaining communication between network nodes that are subjected to a packet attack

A method is disclosed that enables the implementation of an embedded firewall at a telecommunications endpoint. In particular, the illustrative embodiment of the present invention addresses the relationship between the application, firewall engine, and packet-classification rules database that are all resident at the endpoint. In the variations of the illustrative embodiment that are described herein, the application: (i) directly communicates with the co-resident firewall engine such as through local message passing, (ii) shares memory with the firewall engine, and (iii) makes socket calls to the operating system that are intercepted by a middleware layer that subsequently modifies the rules database, depending on the socket call. The common thread to these techniques is that the application, firewall engine, and rules database are co-resident at the endpoint, which is advantageous in the implementation of the embedded firewall.

Embedded firewall at a telecommunications endpoint

A method is disclosed that enables the avoidance of a processor overload of a telecommunications endpoint device that is susceptible to traffic floods. An enhanced network switch sets the speed on one of its data ports as a specific function of the speeds of the devices that are connected to one or more of its other data ports. This behavior is different from that of network switches in the prior art, in which the data rate of a port in the prior art is auto-negotiated to the highest speed that can be supported by the network elements at either end of the port's connection, regardless of the other devices present. By considering the specific devices that are connected, the enhanced network switch is able to limit the amount of traffic that is directed by an upstream device, such as a router, towards a device with limited processor capability, such as a packet-based phone.

Network switch that is optimized for a telephony-capable endpoint

A method is disclosed that enables the transmission of a digital message along with a corresponding information signal, such as audio or video. The supplemental information contained in digital messages can be used for a variety of purposes, such as enabling or enhancing packet authentication. In particular, a telecommunications device that is processing an information signal from its user, such as a speech signal, encrypts the information signal by performing a bitwise exclusive-or of an encryption key stream with the information signal stream. The device, such as a telecommunications endpoint, then intersperses the bits of the digital message throughout the encrypted signal in place of those bits overwritten, in a process referred to as 'watermarking.' The endpoint then transmits the interspersed digital message bits as part of a composite signal that also comprises the encrypted information bits. No additional bits are appended to the packet to be transmitted, thereby addressing compatibility issues.

Signal watermarking in the presence of encryption

A method is disclosed that enables the transmission of a digital message along with a corresponding media information signal, such as audio or video. A telecommunications device that is processing the information signal from its user, such as a speech signal, encodes the information signal by using a model-based compression coder. One such device is a telecommunications endpoint. Then, based on an evaluation of the perceptual significance of each encoded bit, or on some other meaningful characteristic of the signal, the endpoint's processor: (i) determines which encoded bits can be overwritten; and (ii) intersperses the digital message bits throughout the encoded signal in place of the overwritten bits. The endpoint then transmits those digital message bits as part of the encoded information signal. In this way, no additional bits are appended to the packet to be transmitted, thereby addressing the issue of compatibility with existing protocols and firewalls.

Transmission of a digital message interspersed throughout a compressed information signal

Performance problems or other conditions are analyzed in a system comprising a plurality of endpoint devices and an associated centralized or distributed controller. End-to-end measurements are obtained for respective paths through the network, for example, using communications between the endpoint devices. For a given end-to-end measurement obtained for a particular one of the paths, a value of a performance indicator for the path is determined and the performance indicator value is assigned to each of a plurality of links of the path. The determining and assigning operations are repeated for additional ones of the end-to-end measurements, the links are grouped into one or more exculpation or inculpation sets based on how many times a particular performance indicator value has been assigned to each of the links, and the one or more sets are utilized to determine, for example, the location of a performance problem in the network.

Root cause analysis of network performance based on exculpation or inculpation sets

Network topology information is determined in a network-based communication system by generating communications between, for example, selected pairs of endpoint devices each associated with a network. A given one of the communications is sent from a first one of the endpoint devices to a second one of the endpoint devices and returned from the second endpoint device to the first endpoint device. Information contained in the communication as received at the first endpoint device from the second endpoint device is processed to determine network topology information characterizing at least a portion of the network.

Method and apparatus for determination of network topology

Techniques for determining a problem location or otherwise characterizing a network comprising a plurality of processing elements, including at least one processing element associated with performance of a packet encapsulation operation of an encapsulation protocol. The packet encapsulation operation is performed on a test packet to generate an encapsulated packet, the test packet having a time to live (TTL) value and an identifier. In conjunction with performance of the packet encapsulation operation, the TTL value and the identifier of the test packet are copied to a header of the encapsulated packet. The encapsulated packet is transmitted, and a determination is made as to whether a reply packet has been received responsive to transmission of the encapsulated packet. The reply packet, if any, is processed to obtain information utilizable in determining the problem location or otherwise characterizing the network. By way of example, these operations may be repeated, for subsequent test packets with increasing TTL values, until an amount of router hop information sufficient to determine the problem location is obtained.

Automatic determination of connectivity problem locations or other network-characterizing information in a network utilizing an encapsulation protocol

A method and apparatus for testing a digital network having a plurality of subnetworks by determining by one of a plurality of user endpoint devices assigned to one of the plurality of subnetworks upon the one of the plurality of user endpoint devices being idle that the one of the plurality of user endpoint devices should perform the functions of a testing user endpoint device for the one of the plurality of subnetworks; identifying the one of plurality of user endpoint devices to a server or a distributed system of servers as a testing user endpoint device; obtaining the identifies of other testing user endpoint devices in other ones of the plurality of subnetworks from the server; and testing the network by transmission of test packets to other ones of the testing user endpoint devices in the other ones of the plurality of subnetworks.

Method and apparatus for determining endpoints for use as testing devices

Techniques are disclosed for improved monitoring and analysis of VoIP communications, multimedia communications or other types of network traffic in a network-based communication system. In accordance with one aspect of the invention, endpoint devices of the network-based communication system are configurable so as to collectively implement a distributed monitoring and analysis system which does not require a centralized testing server or other centralized controller. Distributed test units associated with the endpoint devices may be utilized in implementing the distributed monitoring and analysis system, and are preferably configured to support a web-based user interface providing access to measurement data. The endpoint devices may be advantageously organized into a hierarchy comprising a plurality of zones, with each of the endpoint devices belonging to at least one zone. For each zone, one of the endpoint devices may be designated as a zone leader for controlling the periodic generation of communications between selected endpoint devices that belong to subzones of that zone in the hierarchy.

Growing community of inventors

Basking Ridge, NJ, United States of America

Akshay Adhikari