Avaya Inc.

Lucent Technologies Inc.

Avaya Technology LLC

Symbol Technologies, LLC

Sachin Garg

Navjot Singh

Akshay Adhikari

Yu-Sung Wu

Anjur Sundaresan Krishnakumar

Timothy Tsai

Yennun Huang

Martin Kappes

Sampath Rangarajan

Shalini Yajnik

Saurabh Bagchi

Mahalingam Mani

Mark Joseph Bearden

Woei-Jyh Lee

David Thomas Stott

Sridhar Vasireddy, Legal Representative

Aad Petrus Antonius Van Moorsel

Adrianus Petrus Antonius Van Moorsel

J&uuml;rgen Sch&ouml;nw&auml;lder

Aad Petrus-Antonius Van Moorsel

Edward Vincent Naybor

Chandra M R Kintala

Ranjith Vasireddy

An apparatus and method are disclosed for detecting intrusions in Voice over Internet Protocol systems, without the use of an attack signature database. In particular, the illustrative embodiment is based on the observation that some VoIP-related protocols (e.g., the Session Initiation Protocol [SIP], etc.) are simple enough to be represented by a finite-state machine (FSM) of compact size. A finite-state machine is maintained for each session/node/protocol combination, and any illegal state or state transition&#x2014;which might be the result of a malicious attack&#x2014;is flagged as a potential intrusion.

Signature-free intrusion detection

An apparatus and method for detecting potentially-improper call behavior (e.g., SPIT, etc.) are disclosed. The illustrative embodiment of the present invention is based on finite-state machines (FSMs) that represent the legal states and state transitions of a communications protocol at a node during a Voice over Internet Protocol (VoIP) call. In accordance with the illustrative embodiment, a library of FSM execution profiles associated with improper call behavior is maintained. When there is a match between the behavior of a finite-state machine during a call and an execution profile in the library, an alert is generated.

State machine profiling for voice over IP calls

An apparatus and method for detecting intrusions in Voice over Internet Protocol systems with distributed stateful intrusion detection. When a Session Initiation Protocol (SIP) signal is received as an application-layer protocol signal, the received application-layer protocol signal is distributed to a first finite-state machine and to a second finite-state machine. A data processing system detects that the application-layer protocol enters a first application-layer protocol state S1 at a first node at a first time, determines whether the application-layer protocol fails to enter a second application-layer protocol state S2 at a second node within &#x3b4; seconds, a positive real number, and generates a signal that indicates a potential intrusion in response to the determination.

Distributed stateful intrusion detection for voice over IP

An apparatus and method for detecting potentially-improper call behavior (e.g., SPIT, etc.) are disclosed. The illustrative embodiment of the present invention is based on finite-state machines (FSMs) that represent the legal states and state transitions of communications protocols at nodes during Voice over Internet Protocol (VoIP) calls. In accordance with the illustrative embodiment, a library of FSM execution profiles associated with improper call behavior and a set of rules (or rule base) associated with improper FSM behavior over one or more calls are maintained. When the behavior of one or more finite-state machines during one or more calls matches either an execution profile in the library or a rule in the rule base, an alert is generated.

Multi-node and multi-call state machine profiling for detecting SPIT

A method is disclosed that enables mitigating at least some of the problems caused by a packet attack. When a first Internet Protocol (IP)-capable device is subjected to a packet attack, it indicates periodically to a second IP-capable device that certain communications with the first device are to be suspended. The periodic transmitting of the indication is performed at a slower rate than the keep-alive mechanism that is normally used to detect loss of connectivity. When the second device receives the transmitted indication, it refrains from transmitting keep-alive messages to the first device for a predetermined interval. Meanwhile, the first device also refrains from transmitting keep-alive messages to the second device for a similar interval. In transmitting the suspend indication, the illustrative embodiment seeks to prevent pairs of communicating devices that are experiencing packet attacks from continuing their operation under the erroneous assumption that each device is unavailable.

Maintaining communication between network nodes that are subjected to a packet attack

A method is disclosed that enables the implementation of an embedded firewall at a telecommunications endpoint. In particular, the illustrative embodiment of the present invention addresses the relationship between the application, firewall engine, and packet-classification rules database that are all resident at the endpoint. In the variations of the illustrative embodiment that are described herein, the application: (i) directly communicates with the co-resident firewall engine such as through local message passing, (ii) shares memory with the firewall engine, and (iii) makes socket calls to the operating system that are intercepted by a middleware layer that subsequently modifies the rules database, depending on the socket call. The common thread to these techniques is that the application, firewall engine, and rules database are co-resident at the endpoint, which is advantageous in the implementation of the embedded firewall.

Embedded firewall at a telecommunications endpoint

A method is disclosed that enables the avoidance of a processor overload of a telecommunications endpoint device that is susceptible to traffic floods. An enhanced network switch sets the speed on one of its data ports as a specific function of the speeds of the devices that are connected to one or more of its other data ports. This behavior is different from that of network switches in the prior art, in which the data rate of a port in the prior art is auto-negotiated to the highest speed that can be supported by the network elements at either end of the port's connection, regardless of the other devices present. By considering the specific devices that are connected, the enhanced network switch is able to limit the amount of traffic that is directed by an upstream device, such as a router, towards a device with limited processor capability, such as a packet-based phone.

Network switch that is optimized for a telephony-capable endpoint

A technique is disclosed that enables the run-time behavior of a data-processing system to be analyzed and, in many cases, to be predicted. In particular, the illustrative embodiment of the present invention comprises i) transforming the messages that constitute an unstructured log into a numerical series and ii) applying a time-series analysis on the resultant series for the purpose of pattern detection. Indeed, it is recognized in the illustrative embodiment that the problem really is to detect patterns that depict aspects of system behavior, regardless of the textual content of the individual log messages. In other words, by analyzing the totality of the messages in the log or logs&#x2014;as opposed to looking for pre-defined patterns of the individual messages&#x2014;system behavior can be mapped and understood. The mapping helps in characterizing the system for the purposes of predicting failure, determining the time required to reach stability during failure recovery, and so forth.

Message log analysis for system behavior evaluation

A method is disclosed that enables the transmission of a digital message along with a corresponding information signal, such as audio or video. The supplemental information contained in digital messages can be used for a variety of purposes, such as enabling or enhancing packet authentication. In particular, a telecommunications device that is processing an information signal from its user, such as a speech signal, encrypts the information signal by performing a bitwise exclusive-or of an encryption key stream with the information signal stream. The device, such as a telecommunications endpoint, then intersperses the bits of the digital message throughout the encrypted signal in place of those bits overwritten, in a process referred to as 'watermarking.' The endpoint then transmits the interspersed digital message bits as part of a composite signal that also comprises the encrypted information bits. No additional bits are appended to the packet to be transmitted, thereby addressing compatibility issues.

Signal watermarking in the presence of encryption

A method is disclosed that enables the transmission of a digital message along with a corresponding media information signal, such as audio or video. A telecommunications device that is processing the information signal from its user, such as a speech signal, encodes the information signal by using a model-based compression coder. One such device is a telecommunications endpoint. Then, based on an evaluation of the perceptual significance of each encoded bit, or on some other meaningful characteristic of the signal, the endpoint's processor: (i) determines which encoded bits can be overwritten; and (ii) intersperses the digital message bits throughout the encoded signal in place of the overwritten bits. The endpoint then transmits those digital message bits as part of the encoded information signal. In this way, no additional bits are appended to the packet to be transmitted, thereby addressing the issue of compatibility with existing protocols and firewalls.

Transmission of a digital message interspersed throughout a compressed information signal

A call processing system, which may include multiple distributed call center sites, utilizes a local back-off approach to endpoint registration. The call processing system comprises a plurality of endpoints and at least a first server, wherein the endpoints register with the first server in order to send and receive calls in the call processing system. Responsive to an end-to-end connectivity failure or other designated event, a registration process is initiated in the call processing system for a given one of the endpoints. The issuance of at least one message of the sequence for the given endpoint is controlled so as to provide a local random back-off or other local back-off of the controlled message at that endpoint. For example, a second server implemented as an aggregation server may be operative to control the issuance of messages by the endpoints so as to provide a local random back-off for each of the plurality of endpoints by staggering the delivery of failure notifications to the endpoints.

Endpoint registration with local back-off in a call processing system

A method for detecting intrusions that employ messages of two or more protocols is disclosed. Such intrusions might occur in Voice over Internet Protocol (VoIP) systems, as well as in systems in which two or more protocols support some service other than VoIP. In the illustrative embodiment of the present invention, a stateful intrusion-detection system is capable of employing rules that have cross-protocol pre-conditions. The illustrative embodiment can use such rules to recognize a variety of VoIP-based intrusion attempts, such as call hijacking, BYE attacks, etc. In addition, the illustrative embodiment is capable of using such rules to recognize other kinds of intrusion attempts in which two or more protocols support a service other than VoIP. The illustrative embodiment also comprises a stateful firewall that is capable of employing rules with cross-protocol pre-conditions.

Stateful and cross-protocol intrusion detection for voice over IP

A method and system for controlling the bandwidths of data traffic over virtual private networks are provided. The method includes classifying the data traffic for the virtual private network into different flows, monitoring a current bandwidth usage by at least one of the flows, comparing the current bandwidth usage with a predetermined threshold for the flow, and performing a bandwidth control operation for the flow if the current bandwidth usage exceeds the predetermined threshold for that flow.

System and method for providing bandwidth management for VPNs

An image projection module within a housing accessory is operative for causing selected pixels in a raster pattern to be illuminated to produce an image at different image planes of VGA quality. A personal media player is connected to the housing accessory and the image projection module to supply image signals for the image to be projected.

Growing community of inventors

Green Brook, NJ, United States of America

Sachin Garg