Patent ID: 11943239
Assignee: LEVEL 3 COMMUNICATIONS, LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 14:
15. A system, comprising:
a computing system, comprising:
a data collection engine;
a policy engine;
at least one first processor; and
a first non-transitory computer readable medium communicatively coupled to the at least one first processor, the first non-transitory computer readable medium having stored thereon computer software comprising a first set of instructions that, when executed by the at least one first processor, causes the computing system to:
receive, using the data collection engine and from a first router among a plurality of routers in a network, first session initiation protocol (“SIP”) data, the first SIP data indicating a request to initiate a SIP-based media communication session between a calling party at a source address in an originating network and a called party at a destination address in the network;
analyze, using the policy engine, the received first SIP data to determine whether the received first SIP data comprises any abnormalities indicative of potential fraudulent or malicious actions; and
based on a determination that the received first SIP data comprises at least one abnormality indicative of potential fraudulent or malicious actions, rerouting, using the policy engine, the first SIP data to a first security deep packet inspection (“DPI”) engine among a plurality of security DPI engines; and
the first security DPI engine, comprising:
at least one second processor; and
a second non-transitory computer readable medium communicatively coupled to the at least one second processor, the second non-transitory computer readable medium having stored thereon computer software comprising a second set of instructions that, when executed by the at least one second processor, causes the first security DPI engine to:
perform a deep scan of the received first SIP data to identify any known fraudulent or malicious attack vectors contained within the received first SIP data and to determine whether the calling party is a known malicious entity or whether the source address is associated with a known malicious entity; and
in response to the security DPI engine identifying at least one known fraudulent or malicious attack vector contained within the received first SIP data, initiating one or more mitigation actions,
wherein one of the first set of instructions, when executed by the at least one first processor, further causes the computing system to or the second set of instructions, when executed by the at least one second processor, causes the first security DPI engine to:
normalize, after initiating the one or more mitigation actions, all network traffic to the destination address after at least one of a predetermined period or a predetermined number of SIP data checks showing no abnormalities indicative of potential fraudulent or malicious actions.