Patent ID: 9178898
Filing Date: 2015-11-03
Classification: H04L

Abstract:
1. A method for intrusion detection with distributed stateful intrusion detection, comprising: receiving a Session Initiation Protocol (SIP) signal as an application-layer protocol signal at a receiver of a Voice Over Internet Protocol (VoIP) intrusion detection systems from a network; distributing the received application-layer protocol signal to a first finite-state machine and to a second finite-state machine; detecting, by a data processing system, that the application-layer protocol enters a first application-layer protocol state S determining, by the data processing system, whether the application-layer protocol fails to enter a second application-layer protocol state S generating, by the data-processing system, an alert signal that indicates a potential intrusion in response to the determination, wherein said first application-layer protocol state corresponds a first finite-state machine for said protocol and said first node, and wherein said second application-layer protocol state corresponds to a second finite-state machine for said protocol and said second node, wherein transition to an application-layer protocol state is based upon communication of an application-layer protocol message, and wherein said data-processing system comprises hardware.