Patent ID: 7774849

Claim:
A method for detecting and mitigating a denial of service (DoS) attack in a telecommunications signaling network, the method comprising: (a) collecting per link traffic rate information for a plurality of signaling links in a telecommunications signaling network; (b) determining whether a traffic rate on a first signaling link of the plurality of signaling links exceeds a traffic rate on at least a second signaling link of the plurality of signaling links by a predetermined threshold, wherein the traffic rate on a signaling link includes a total number of signaling messages that traverse the signaling link during a time period, the first and second signaling links are members of the same signaling linkset that interconnects a pair of telecommunications network signaling nodes and determining whether the traffic rate on the first signaling link exceeds the traffic rate on at least the second signaling link includes comparing the traffic rate on the first signaling link to the traffic rate on the second signaling link; and (c) in response to determining that the traffic rate on the first signaling link exceeds the traffic rate on the second signaling link by a predetermined threshold, indicating a denial of service attack caused by an attacker gaining access to the first signaling link but not the second signaling link.