Abstract: The present invention relates to methods and apparatus for dynamically detecting and/or mitigating threats in communications systems. Exemplary methods and apparatus of the present invention allow for a combination of automated and operator controlled responses to threats. While an operator is provided an opportunity to provide input on how to respond to a threat, after one or more threats of a given type are identified, the system will automatically take corrective action without waiting for operator input and/or in the absence of operator input following notification of a threat.

Abstract: The present invention relates to methods, systems, and apparatus for generating and/or using training data.

Abstract: The present invention relates to communications methods and apparatus dynamically detecting and/or mitigating anomalies in communications systems/networks. An exemplary method embodiment includes the steps of: (i) storing a set of N key performance indicator (KPI) models; (ii) associating each of a plurality of recurring time slots of a recurring time frame on a per group member basis with one of the N KPI models wherein the associating including associating a first group member of a first group and a first recurring time slot with a first one of the N models, the first one of the N models being a first model; (iii) receiving event data for the first group member for a first time period; and (iv) determining based on the first model if a key performance indicator value for the first group member and first time period is anomalous.

Abstract: The present invention relates to methods and apparatus for dynamically detecting and/or mitigating threats in communications systems. Exemplary methods and apparatus of the present invention allow for a combination of automated and operator controlled responses to threats. While an operator is provided an opportunity to provide input on how to respond to a threat, after one or more threats of a given type are identified, the system will automatically take corrective action without waiting for operator input and/or in the absence of operator input following notification of a threat.

Abstract: The present invention relates to methods and apparatus for dynamically detecting and/or mitigating threats in communications systems. Exemplary methods and apparatus of the present invention allow for a combination of automated and operator controlled responses to threats. While an operator is provided an opportunity to provide input on how to respond to a threat, after one or more threats of a given type are identified, the system will automatically take corrective action without waiting for operator input and/or in the absence of operator input following notification of a threat.

Abstract: The present invention relates to communications methods and apparatus dynamically detecting and/or mitigating anomalies in communications systems/networks. An exemplary method embodiment includes the steps of: (i) storing a set of N key performance indicator (KPI) models; (ii) associating each of a plurality of recurring time slots of a recurring time frame on a per group member basis with one of the N KPI models wherein the associating including associating a first group member of a first group and a first recurring time slot with a first one of the N models, the first one of the N models being a first model; (iii) receiving event data for the first group member for a first time period; and (iv) determining based on the first model if a key performance indicator value for the first group member and first time period is anomalous.

Abstract: The present invention relates to methods and apparatus for detecting, minimizing and/or preventing message processing faults and in particular message processing fault avalanches at a single processing device and among a cluster of message processing devices. An exemplary method embodiment includes: enabling message blocking at a Session Border Controller (SBC) for Session Initiation Protocol (SIP) messages including a first key value in response to a first threshold number of SIP messages including the first key value having caused a SIP message processing failure; receiving, at the SBC, a SIP message including at least one key value; determining if message blocking is enabled for one or more key values included in the SIP message; and dropping by the SBC the SIP message in response to determining that message blocking is enabled for one or more key values included in the SIP message, but otherwise processing the SIP message by the SBC.

Abstract: Methods and apparatus for implementing and operating malicious transaction detection systems. An exemplary method embodiment includes the steps of: (i) operating, a malicious transaction detection system, to receive communications session establishment data; operating, the malicious transaction detection system, to determine a probability of whether or not the communications session establishment data indicates that the communications session is malicious; and when the determined probability is greater than or equal to a predetermined threshold value determining that a transaction corresponding to the received communications session establishment data is malicious; and when the determined probability is less than the predetermined threshold value determining that the transaction corresponding to the received communications session establishment data is not malicious; and wherein the malicious transaction detection system includes a determination model trained using synthetic communications session data.

Abstract: The present invention relates to communications methods and apparatus dynamically detecting and/or mitigating anomalies in communications systems/networks. An exemplary method embodiment includes the steps of: (i) storing a set of N key performance indicator (KPI) models; (ii) associating each of a plurality of recurring time slots of a recurring time frame on a per group member basis with one of the N KPI models wherein the associating including associating a first group member of a first group and a first recurring time slot with a first one of the N models, the first one of the N models being a first model; (iii) receiving event data for the first group member for a first time period; and (iv) determining based on the first model if a key performance indicator value for the first group member and first time period is anomalous.

Abstract: The present invention relates to methods and apparatus for detecting, minimizing and/or preventing message processing faults and in particular message processing fault avalanches at a single processing device and among a cluster of message processing devices. An exemplary method embodiment includes: enabling message blocking at a Session Border Controller (SBC) for Session Initiation Protocol (SIP) messages including a first key value in response to a first threshold number of SIP messages including the first key value having caused a SIP message processing failure; receiving, at the SBC, a SIP message including at least one key value; determining if message blocking is enabled for one or more key values included in the SIP message; and dropping by the SBC the SIP message in response to determining that message blocking is enabled for one or more key values included in the SIP message, but otherwise processing the SIP message by the SBC.

Abstract: Methods, apparatus and systems for load balancing Session Initiation Protocol session transactions among a self-organized cluster of SIP processing devices. An exemplary method embodiment includes the steps of dynamically forming a load balancing cluster of SIP processing devices from a plurality of SIP processing devices, said cluster of SIP processing devices being self-organized; dynamically building a communications network, by said cluster of SIP processing devices, for distributing session transaction load state information among the SIP processing devices in the cluster; and each of the SIP processing devices of the cluster asynchronously determining session transaction load state information on a recurring basis reflecting its current session transaction load state. In some embodiments, the SIP processing devices are session border controllers.

Abstract: The present invention relates to methods and apparatus for detecting, minimizing and/or preventing message processing faults and in particular message processing fault avalanches at a single processing device and among a cluster of message processing devices. An exemplary method embodiment includes: enabling message blocking at a Session Border Controller (SBC) for Session Initiation Protocol (SIP) messages including a first key value in response to a first threshold number of SIP messages including the first key value having caused a SIP message processing failure; receiving, at the SBC, a SIP message including at least one key value; determining if message blocking is enabled for one or more key values included in the SIP message; and dropping by the SBC the SIP message in response to determining that message blocking is enabled for one or more key values included in the SIP message, but otherwise processing the SIP message by the SBC.

Abstract: The present invention relates to methods and apparatus for dynamically detecting and/or mitigating threats in communications systems. Exemplary methods and apparatus of the present invention allow for a combination of automated and operator controlled responses to threats. While an operator is provided an opportunity to provide input on how to respond to a threat, after one or more threats of a given type are identified, the system will automatically take corrective action without waiting for operator input and/or in the absence of operator input following notification of a threat.

Abstract: The present invention relates to systems, apparatus and methods for the computation and use of session, device and/or user signatures for determining communications session types, device types, and/or user signatures. An exemplary system in accordance with an embodiment of the invention includes: a first device, the first device including: a receiver that receives a first set of session control messages belonging to a first communications session, said first set of session control messages including at least one session control message; a feature extractor that extracts a first set of device features from the first set of session control messages; and a first neural network that determines a device signature from the first set of session control messages based on said set of device features.

Abstract: The present invention relates to systems, apparatus and methods for the computation and use of session, device and/or user signatures for determining communications session types, device types, and/or user signatures. An exemplary method in accordance with an embodiment of the invention includes: receiving a first set of session control messages belonging to a first communications session, the first set of session control messages including at least one session control message; extracting a first set of features from the first set of session control messages; operating one or more neural networks to identify a group session signature to which the first set of session control messages corresponds based on the first set of features, the identified group session signature being one of a plurality of group session signatures.

Abstract: The present invention relates to communications methods and apparatus dynamically detecting and/or mitigating anomalies in communications systems/networks.

Abstract: The present invention relates to methods and apparatus for dynamically detecting and/or mitigating threats in communications systems. Exemplary methods and apparatus of the present invention allow for a combination of automated and operator controlled responses to threats. While an operator is provided an opportunity to provide input on how to respond to a threat, after one or more threats of a given type are identified, the system will automatically take corrective action without waiting for operator input and/or in the absence of operator input following notification of a threat.

Abstract: The present invention relates to systems, apparatus and methods for the computation and use of session, device and/or user signatures for determining communications session types, device types, and/or user signatures. An exemplary system in accordance with an embodiment of the invention includes: a first device, the first device including: a receiver that receives a first set of session control messages belonging to a first communications session, said first set of session control messages including at least one session control message; a feature extractor that extracts a first set of device features from the first set of session control messages; and a first neural network that determines a device signature from the first set of session control messages based on said set of device features.

Abstract: The present invention relates to systems, apparatus and methods for the computation and use of session, device and/or user signatures for determining communications session types, device types, and/or user signatures. An exemplary method in accordance with an embodiment of the invention includes: receiving a first set of session control messages belonging to a first communications session, the first set of session control messages including at least one session control message; extracting a first set of features from the first set of session control messages; operating one or more neural networks to identify a group session signature to which the first set of session control messages corresponds based on the first set of features, the identified group session signature being one of a plurality of group session signatures.

Abstract: The present invention relates to communications methods and apparatus dynamically detecting and/or mitigating anomalies in communications systems/networks.