Patent ID: 9537875
Date: 2017-01-03
CPC Classifications: H04L

Claim:
1. A method of handling potentially malicious communication activity in a communication system, including processing communication activity which is potentially malicious differently to communication activity which is acceptable, wherein the communication system comprises at least a traffic handler comprising at least one processor and at least one memory, the method comprising: at the traffic handler, distributing at least some incoming media traffic into a first set of traffic groups according to a first grouping scheme such that communication activity from a potentially malicious source is grouped in a given traffic group in which communication activity from an acceptable source is also grouped; at the traffic handler, processing the media traffic distributed into the given traffic group, both from the acceptable source and the potentially malicious source, using a traffic processing mode associated with acceptable communication activity until a threshold rate limit associated with the given traffic group is exceeded, wherein the threshold rate limit associated with the given traffic group is a maximum acceptable amount of media traffic during a monitoring time period associated with the given traffic group, wherein the traffic handler continues to receive traffic from both the acceptable source and the potentially malicious source during the monitoring time period; at the traffic handler, detecting potentially malicious communication activity in the given traffic group in response to an amount of media traffic distributed into the given traffic group during the monitoring time period associated with the given traffic group exceeding the maximum acceptable amount of media traffic associated with the given traffic group; at the traffic handler, in response to said detecting potentially malicious communication activity in the given traffic group, processing further media traffic distributed into the given traffic group using a first traffic processing mode associated with potentially malicious communication activity during a remainder of the monitoring time period, the first traffic processing mode comprising discarding at least some of the further media traffic, both from the acceptable source and the potentially malicious source, that is distributed into the given traffic group during the remainder of the monitoring time period; wherein the discarded further media traffic comprises traffic recognized by the traffic handler as traffic from the acceptable source as well as traffic from the potentially malicious source, and wherein the discarded further traffic is discarded during the remainder of the monitoring time period; at the traffic handler, processing media traffic in at least one other traffic group using a second traffic processing mode associated with acceptable communication activity; and at the traffic handler, in response to a dynamic trigger, altering the grouping scheme to one or more further grouping schemes and distributing at least some subsequent incoming media traffic into one or more further sets of traffic groups according to the one or more further grouping schemes in order that the communication activity from the acceptable source is likely to be subsequently grouped into a traffic group which is different to a group into which the communication activity from the potentially malicious source is subsequently grouped.