Avaya Inc.

Yu-Sung Wu

Navjot Singh

Sachin Garg

Akshay Adhikari

Timothy Tsai

Saurabh Bagchi

An apparatus and method are disclosed for detecting intrusions in Voice over Internet Protocol systems, without the use of an attack signature database. In particular, the illustrative embodiment is based on the observation that some VoIP-related protocols (e.g., the Session Initiation Protocol [SIP], etc.) are simple enough to be represented by a finite-state machine (FSM) of compact size. A finite-state machine is maintained for each session/node/protocol combination, and any illegal state or state transition&#x2014;which might be the result of a malicious attack&#x2014;is flagged as a potential intrusion.

Signature-free intrusion detection

An apparatus and method for detecting potentially-improper call behavior (e.g., SPIT, etc.) are disclosed. The illustrative embodiment of the present invention is based on finite-state machines (FSMs) that represent the legal states and state transitions of a communications protocol at a node during a Voice over Internet Protocol (VoIP) call. In accordance with the illustrative embodiment, a library of FSM execution profiles associated with improper call behavior is maintained. When there is a match between the behavior of a finite-state machine during a call and an execution profile in the library, an alert is generated.

State machine profiling for voice over IP calls

An apparatus and method for detecting intrusions in Voice over Internet Protocol systems with distributed stateful intrusion detection. When a Session Initiation Protocol (SIP) signal is received as an application-layer protocol signal, the received application-layer protocol signal is distributed to a first finite-state machine and to a second finite-state machine. A data processing system detects that the application-layer protocol enters a first application-layer protocol state S1 at a first node at a first time, determines whether the application-layer protocol fails to enter a second application-layer protocol state S2 at a second node within &#x3b4; seconds, a positive real number, and generates a signal that indicates a potential intrusion in response to the determination.

Distributed stateful intrusion detection for voice over IP

An apparatus and method for detecting potentially-improper call behavior (e.g., SPIT, etc.) are disclosed. The illustrative embodiment of the present invention is based on finite-state machines (FSMs) that represent the legal states and state transitions of communications protocols at nodes during Voice over Internet Protocol (VoIP) calls. In accordance with the illustrative embodiment, a library of FSM execution profiles associated with improper call behavior and a set of rules (or rule base) associated with improper FSM behavior over one or more calls are maintained. When the behavior of one or more finite-state machines during one or more calls matches either an execution profile in the library or a rule in the rule base, an alert is generated.

Multi-node and multi-call state machine profiling for detecting SPIT

A method for detecting intrusions that employ messages of two or more protocols is disclosed. Such intrusions might occur in Voice over Internet Protocol (VoIP) systems, as well as in systems in which two or more protocols support some service other than VoIP. In the illustrative embodiment of the present invention, a stateful intrusion-detection system is capable of employing rules that have cross-protocol pre-conditions. The illustrative embodiment can use such rules to recognize a variety of VoIP-based intrusion attempts, such as call hijacking, BYE attacks, etc. In addition, the illustrative embodiment is capable of using such rules to recognize other kinds of intrusion attempts in which two or more protocols support a service other than VoIP. The illustrative embodiment also comprises a stateful firewall that is capable of employing rules with cross-protocol pre-conditions.

Growing community of inventors

West Lafayette, IN, United States of America

Yu-Sung Wu