Patent ID: 8447855

Claim:
A method for preventing session initiation protocol (SIP) attacks, the method comprising: receiving, from a protected entity, a plurality of SIP response messages comprising at least one pre-defined SIP response code, wherein the pre-defined SIP response code comprises one or more SIP error response codes; extracting at least one user identifier from the plurality of SIP response messages; computing both of a frequency of the plurality of SIP response messages and a count of the plurality of SIP response messages corresponding to each user identifier of the at least one user identifier, wherein the frequency of the plurality of SIP response messages is a frequency of an occurrence of a sequence of successive SIP response messages including the one or more SIP error response codes, thereby computing the frequency of negative events for the at least one user identifier; calculating a degree of attack corresponding to each user identifier using the computed frequency and the count of the plurality of SIP response messages including the SIP error response codes; and determining a monitoring interval for each user identifier based upon the computed degree of attack for monitoring the plurality of SIP response messages.