Abstract: The present invention relates to communications methods and apparatus dynamically detecting and/or mitigating anomalies in communications systems/networks.

Abstract: The present invention relates to methods and apparatus for dynamically detecting and/or mitigating threats in communications systems. Exemplary methods and apparatus of the present invention allow for a combination of automated and operator controlled responses to threats. While an operator is provided an opportunity to provide input on how to respond to a threat, after one or more threats of a given type are identified, the system will automatically take corrective action without waiting for operator input and/or in the absence of operator input following notification of a threat.

Abstract: The present invention relates to systems, apparatus and methods for the computation and use of session, device and/or user signatures for determining communications session types, device types, and/or user signatures. An exemplary method in accordance with an embodiment of the invention includes: receiving a first set of session control messages belonging to a first communications session, the first set of session control messages including at least one session control message; extracting a first set of features from the first set of session control messages; operating one or more neural networks to identify a group session signature to which the first set of session control messages corresponds based on the first set of features, the identified group session signature being one of a plurality of group session signatures.

Abstract: The present invention relates to systems, apparatus and methods for the computation and use of session, device and/or user signatures for determining communications session types, device types, and/or user signatures. An exemplary system in accordance with an embodiment of the invention includes: a first device, the first device including: a receiver that receives a first set of session control messages belonging to a first communications session, said first set of session control messages including at least one session control message; a feature extractor that extracts a first set of device features from the first set of session control messages; and a first neural network that determines a device signature from the first set of session control messages based on said set of device features.

Abstract: The present invention relates to communications methods and apparatus dynamically detecting and/or mitigating anomalies in communications systems/networks.

Abstract: The present invention relates to communications methods and apparatus dynamically detecting and/or mitigating anomalies in communications systems/networks. An exemplary method embodiment includes the steps of: (i) storing a set of N key performance indicator (KPI) models; (ii) associating each of a plurality of recurring time slots of a recurring time frame on a per group member basis with one of the N KPI models wherein the associating including associating a first group member of a first group and a first recurring time slot with a first one of the N models, the first one of the N models being a first model; (iii) receiving event data for the first group member for a first time period; and (iv) determining based on the first model if a key performance indicator value for the first group member and first time period is anomalous.

Abstract: The present invention relates to methods, systems and apparatus for identifying and acting upon suspect robocalls. An exemplary method embodiment includes the steps of processing call records of a customer to identify calls which are possibly from a robocaller, based on at least one of i) a call characteristic or ii) a call pattern; storing calling party source identification information of the identified calls in a suspect robocall database; processing an incoming call, said processing including comparing calling party source identification information of an incoming call to the calling party source identification information in the suspect robocall database; and completing the incoming call in a standard manner if the incoming call is not in the suspect robocall database; and handling the call as a suspect robocall if the incoming calling party source identification information is in the suspect robocall database.

Abstract: The present invention relates to communications methods and apparatus dynamically detecting and/or mitigating anomalies in communications systems/networks. An exemplary embodiment includes the steps of: processing a set of call detail records (CDRS), each CDR in said set of CDRs corresponding to an individual call and including multiple information fields providing information about the individual call to which the CDR corresponds, said processing including: generating from said CDRs, on a per CDR basis one or more Field GroupIDs using a hash function; generating for CDRs corresponding to a first Field GroupID a first set of key performance indicators (KPIs), said first set of (KPIs) including one or more KPIs corresponding to the first Field GroupID, said one or more KPIs including at least a first KPI; and determining that a first KPI violation has occurred for the first Field GroupID when the first KPI exceeds a dynamic performance threshold.

Abstract: Methods, apparatus and systems for load balancing Session Initiation Protocol session transactions among a self-organized cluster of SIP processing devices. An exemplary method embodiment includes the steps of dynamically forming a load balancing cluster of SIP processing devices from a plurality of SIP processing devices, said cluster of SIP processing devices being self-organized; dynamically building a communications network, by said cluster of SIP processing devices, for distributing session transaction load state information among the SIP processing devices in the cluster; and each of the SIP processing devices of the cluster asynchronously determining session transaction load state information on a recurring basis reflecting its current session transaction load state. In some embodiments, the SIP processing devices are session border controllers.

Abstract: The present invention relates to methods and apparatus for dynamically detecting and/or mitigating threats in communications systems. Exemplary methods and apparatus of the present invention allow for a combination of automated and operator controlled responses to threats. While an operator is provided an opportunity to provide input on how to respond to a threat, after one or more threats of a given type are identified, the system will automatically take corrective action without waiting for operator input and/or in the absence of operator input following notification of a threat.

Abstract: Methods, apparatus and systems for load balancing Session Initiation Protocol session transactions among a self-organized cluster of SIP processing devices. An exemplary method embodiment includes the steps of dynamically forming a load balancing cluster of SIP processing devices from a plurality of SIP processing devices, said cluster of SIP processing devices being self-organized; dynamically building a communications network, by said cluster of SIP processing devices, for distributing session transaction load state information among the SIP processing devices in the cluster; and each of the SIP processing devices of the cluster asynchronously determining session transaction load state information on a recurring basis reflecting its current session transaction load state. In some embodiments, the SIP processing devices are session border controllers.

Abstract: The present invention relates to methods, systems and apparatus for mitigating denial of service attacks. One exemplary embodiment in accordance with the invention is a method of operating a communication system including the steps of receiving at a first device packets of a first packet flow; sending, from the first device, control information to a switch through which packets of the first packet flow pass or to a control device which controls the switch, the control information including a mask corresponding to a range of expected packet values to be used for determining which packets in the first packet flow should be dropped.

Abstract: Methods and apparatus for providing load balancing in a Software Defined Network (SDN). An exemplary embodiment includes the steps of: receiving by a Session Border Controller (SBC) cluster leader a first SIP invite message including a source IP address, assigning responsibility for processing the received message to a first SBC in a cluster of SBCs, and initiating by the first SBC installation of a first flow table entry into SDN switches used to control packet routing in an SDN network, the first flow table entry controlling SDN switches into which the first flow table entry is installed to replace a destination IP address in received packets which satisfy matching criteria of the first flow table entry with a first SBC IP ingress address of the first SBC and to route received packets matching the criteria of the first flow table entry based on the first SBC IP ingress address.

Abstract: The present invention relates to methods, systems and apparatus for identifying and acting upon suspect robocalls. An exemplary method embodiment includes the steps of processing call records of a customer to identify calls which are possibly from a robocaller, based on at least one of i) a call characteristic or ii) a call pattern; storing calling party source identification information of the identified calls in a suspect robocall database; processing an incoming call, said processing including comparing calling party source identification information of an incoming call to the calling party source identification information in the suspect robocall database; and completing the incoming call in a standard manner if the incoming call is not in the suspect robocall database; and handling the call as a suspect robocall if the incoming calling party source identification information is in the suspect robocall database.

Abstract: The present invention relates to communications methods and apparatus dynamically detecting and/or mitigating anomalies in communications systems/networks. An exemplary embodiment includes the steps of: processing a set of call detail records (CDRS), each CDR in said set of CDRs corresponding to an individual call and including multiple information fields providing information about the individual call to which the CDR corresponds, said processing including: generating from said CDRs, on a per CDR basis one or more Field GroupIDs using a hash function; generating for CDRs corresponding to a first Field GroupID a first set of key performance indicators (KPIs), said first set of (KPIs) including one or more KPIs corresponding to the first Field GroupID, said one or more KPIs including at least a first KPI; and determining that a first KPI violation has occurred for the first Field GroupID when the first KPI exceeds a dynamic performance threshold.

Abstract: The present invention relates to methods, systems and apparatus for mitigating denial of service attacks. One exemplary embodiment in accordance with the invention is a method of operating a communication system including the steps of receiving at a first device packets of a first packet flow; sending, from the first device, control information to a switch through which packets of the first packet flow pass or to a control device which controls the switch, the control information including a mask corresponding to a range of expected packet values to be used for determining which packets in the first packet flow should be dropped.

Abstract: The present invention relates to methods, systems and apparatus for mitigating denial of service attacks. One exemplary embodiment in accordance with the invention is a method of operating a communication system including the steps of receiving at a first device packets of a first packet flow; sending, from the first device, control information to a switch through which packets of the first packet flow pass or to a control device which controls the switch, the control information including a mask corresponding to a range of expected packet values to be used for determining which packets in the first packet flow should be dropped.

Abstract: Methods and apparatus for providing load balancing in a Software Defined Network (SDN). An exemplary embodiment includes the steps of: receiving by a Session Border Controller (SBC) cluster leader a first SIP invite message including a source IP address, assigning responsibility for processing the received message to a first SBC in a cluster of SBCs, and initiating by the first SBC installation of a first flow table entry into SDN switches used to control packet routing in an SDN network, the first flow table entry controlling SDN switches into which the first flow table entry is installed to replace a destination IP address in received packets which satisfy matching criteria of the first flow table entry with a first SBC IP ingress address of the first SBC and to route received packets matching the criteria of the first flow table entry based on the first SBC IP ingress address.

Abstract: Methods and apparatus for detecting VOIP spoofing attacks in systems that provide communication services over IP networks, for gathering information that can be used for preventing or mitigating future malicious attacks, are described. The methods and apparatus send various signals and check for expected responses. Actual responses and/or lack of responses to signals, e.g., messages, are detected, logged and used for making decisions as well as generating a record for informational purposes and analysis which can facilitate identification of common features of malicious packets and/or messages. The methods are well suited for use in a session border controller.

Abstract: Methods and apparatus for supporting authentication for session border controller generated autonomous requests are described. In some embodiments, the session border controller stores a response to a challenge being communicated through the session border controller from an entity with authentication credentials, e.g., a user equipment device, to an authenticating entity. The stored response is available to be used by the SBC at a future time in generating an autonomous request that may be able to pass an authentication check by the authenticating entity. In some embodiments, a session border controller, which has received a challenge to a SBC generated autonomous request from an authenticating entity, generates and sends a request triggering signal to an entity with authentication credentials and subsequently uses the received challenge from the entity with authenticating entity to challenge and acquire a response, e.g., a authorization header, that can will satisfy the authenticating entity.