Patent ID: 8230505

Claim:
An intrusion prevention method executing in an enterprise network, the method comprising: providing a media server, the media server operable to direct communication contacts between two or more communication devices, wherein the media server comprises a processor, a memory, and an application behavior anomaly detector, wherein: the application behavior anomaly detector receiving application level information from a communication application, wherein the communication application executes a communications-related task; the application behavior anomaly detector selecting at least one event, at the application layer, from the application level information, the selected event being at least one of an error, exception, policy violation, and handling rate; the application behavior anomaly detector detecting a potential attack; the application behavior anomaly detector sending application-level attack information to an enterprise behavioral anomaly system; providing an enterprise behavioral anomaly system in communication with the media server, which comprises a processor and memory, executing an interface, anomaly source location engine, and an anomaly prevention engine, wherein: the interface receiving the application-level attack information; the anomaly source location engine locating, with the application-level attack information, an access-level source for the potential attack; when the application-level attack information is indicative of the intrusion, locating at least one of an entry point and an address of a source of the intrusion; and when the application-level attack information is indicative of an intrusion, the anomaly prevention engine implementing an appropriate response to the intrusion, wherein implementing the appropriate response comprises blocking or neutralizing a particular transport address.