Ribbon Communications Operating Company, Inc.

Sonus Networks, Inc.

Quintum Technologies, Inc.

Timothy R Thornton

Shaun Jaikarran Bharrat

Justin Hart

Shambhu Dayal Rai

Kevin Riley

Sridhar Kuppanna

Dilnawaj Ahmed

Rajiv Bhatia

Kevin Neil Isacks

Lisa Villa Neyen

Ki Choon Suh

Cheng T Chen

The present invention relates to methods and apparatus for dynamically detecting and/or mitigating threats in communications systems. Exemplary methods and apparatus of the present invention allow for a combination of automated and operator controlled responses to threats. While an operator is provided an opportunity to provide input on how to respond to a threat, after one or more threats of a given type are identified, the system will automatically take corrective action without waiting for operator input and/or in the absence of operator input following notification of a threat.

Communications methods and apparatus for dynamic detection and/or mitigation of threats and/or anomalies

The present invention relates to communications methods and apparatus dynamically detecting and/or mitigating anomalies in communications systems/networks. An exemplary method embodiment includes the steps of: (i) storing a set of N key performance indicator (KPI) models; (ii) associating each of a plurality of recurring time slots of a recurring time frame on a per group member basis with one of the N KPI models wherein the associating including associating a first group member of a first group and a first recurring time slot with a first one of the N models, the first one of the N models being a first model; (iii) receiving event data for the first group member for a first time period; and (iv) determining based on the first model if a key performance indicator value for the first group member and first time period is anomalous.

Communications methods and apparatus for dynamic detection and/or mitigation of anomalies

The present invention relates to systems, apparatus and methods for the computation and use of session, device and/or user signatures for determining communications session types, device types, and/or user signatures. An exemplary method in accordance with an embodiment of the invention includes: receiving a first set of session control messages belonging to a first communications session, the first set of session control messages including at least one session control message; extracting a first set of features from the first set of session control messages; operating one or more neural networks to identify a group session signature to which the first set of session control messages corresponds based on the first set of features, the identified group session signature being one of a plurality of group session signatures.

Methods, systems and apparatus for using session, device and/or user signatures

The present invention relates to systems, apparatus and methods for the computation and use of session, device and/or user signatures for determining communications session types, device types, and/or user signatures. An exemplary system in accordance with an embodiment of the invention includes: a first device, the first device including: a receiver that receives a first set of session control messages belonging to a first communications session, said first set of session control messages including at least one session control message; a feature extractor that extracts a first set of device features from the first set of session control messages; and a first neural network that determines a device signature from the first set of session control messages based on said set of device features.

The present invention relates to communications methods and apparatus dynamically detecting and/or mitigating anomalies in communications systems/networks. An exemplary method of operating a system to detect traffic anomalies includes the steps of: inputting input values, said input values including i) a set of key performance indicator values and ii) one or more selector values corresponding to a first anomaly group classification instance into a trained neural network; operating the trained neural network to output values corresponding to the inputted set of key performance indicator values; determining a score for the first anomaly group classification instance based on the output values of the trained neural network corresponding to the key performance indicator values, each of said output values corresponding to one key performance indicator input value; and when the score is above a first threshold determining that an anomaly condition exists with respect to the first anomaly group classification instance.

Key performance indicator anomaly detection in telephony networks

Methods and apparatus for deriving and/or generating, user presence information from communication signals monitored by a SBC or PRI Gateway and aggregating and/or distributing the user presence information. An exemplary method embodiment includes the steps of storing a plurality of user profile records, each of the user profile records mapping contact information for a user to one or more user identifiers corresponding to the user; receiving first signaling information; determining a first user corresponding to the first signaling information by comparing at least a first portion of the information contained in the first signaling information to at least a first portion of the information contained in the plurality of user profiles; and generating presence status information for the first user and communicating the first presence status information to a presence server as presence status information corresponding to a first user identifier, said first user identifier corresponding to said first user.

Methods and apparatus for generating, aggregating and/or distributing presence information

A user has a plurality of user identities, e.g., a Google ID, an IMS ID, a PBX phone number, a Lync ID, etc., corresponding to different domains and/or different autonomous systems. A presence aggregation interworking function (PAIF) device aggregates presence state information corresponding to the same user and different non-Lync IDs, formats the aggregated information into a Lync compatible format, and communicates the aggregated formatted presence state information to a Lync Presence server. The Lync Presence server may, and sometimes does, further aggregates the aggregated presence state information received from the PAIF, corresponding to the user, with presence state information from a device using a Lync ID, corresponding to the same user. The Lync presence server distributes the aggregated presence state information to other devices, which have expressed an interest in receiving presence state information corresponding to the user.

Methods and apparatus for aggregating and distributing presence information

Methods and apparatus for aggregating and distributing contact information for a user with multiple user identifiers in a plurality of domains. In one embodiment a set of user identifiers corresponding to a first user includes a first user identifier corresponding to a first domain and a second user identifier corresponding to a second domain. A request is made using the first user identifier for contacts associated in the first domain with the first user identifier and a request is made using the second user identifier, for contacts associated in the second domain with the second user identifier. An aggregated contact list corresponding to the first user is generated from a first contact list received from the first domain and from a second contact list received from the second domain. In some embodiments the aggregated contact list and associated user presence information is distributed to the first and second domains.

Methods and apparatus for aggregating and distributing contact and presence information

Apparatus, and accompanying methods for use therein, for a telephony gateway intended for use, e.g., paired use, at opposite ends of a data network connection, in conjunction with at each end, e.g., a private branch exchange (PBX) for automatically routing telephone calls, e.g., voice, data and facsimile, between two peer PBXs over either a public switched telephone network (PSTN) or a data network, based on, among other aspects, cost considerations for handling each such call and called directory numbers, monitoring quality of service (QoS) then provided through the data network and switching (&ldquo;auto-switching&rdquo;) such calls back and forth between the PSTN and the data network, as needed, in response to dynamic changes in the QoS such that the call is carried over a connection then providing a sufficient QoS.

Application for a voice over IP (VoIP) telephony gateway and methods for use therein

Apparatus, and accompanying methods for use therein, for a telephony gateway intended for use, e.g., paired use, at opposite ends of a data network connection, in conjunction with at each end, e.g., a private branch exchange (PBX) for automatically routing telephone calls, e.g., voice, data and facsimile, between two peer PBXs over either a public switched telephone network (PSTN) or a data network, based on, among other aspects, cost considerations for handling each such call and called directory numbers, monitoring quality of service (QoS) then provided through the data network and switching (&ldquo;auto-switching&rdquo;) such calls back and forth between the PSTN and the data network, as needed, in response to dynamic changes in the QoS such that the call is carried over a connection then providing a sufficient QoS. To support auto-switching, the apparatus embeds, using call independent signaling, certain call-specific information, as non-standard data, within various conventional H.323 messages that transit between the paired gateways. Furthermore, for added local redundancy, this apparatus utilizes peered border elements within an H.323 administrative domain.

Growing community of inventors

Brick, NJ, United States of America

Timothy R Thornton