Denial of service protection for IP telephony systems

A tangible computer-readable storage device having program instructions stored thereon that, upon execution by a computer system for protecting a plurality of enterprise calling systems served by an IP telephony network, cause the computer system to:

• monitor incoming calls directed towards an enterprise calling system of the plurality of enterprise calling systems that is provided IP telephony calling by the IP (Internet Protocol) telephony network wherein each incoming call originates from a sender, wherein the enterprise calling system is assigned a call capacity comprising a plurality of communication channels;
• monitor resource exhaustion within the enterprise calling system by monitoring a number of available communication channels from the plurality of communication channels assigned for use by the enterprise calling system within the IP telephony network;
• and
• enable a protection scheme when the resource exhaustion monitoring indicates the available call capacity has dropped below a first threshold, wherein the executed program instructions of the enabled protection scheme further cause the computer system to:
• identify a suspect sender that has attempted to complete multiple incoming calls to the enterprise calling system;
• determine whether the suspect caller is identified in a suspect caller list, wherein each suspect in the suspect caller list is associated with a duration;
• add the suspect caller to a suspect caller list when the suspect caller is not identified in the suspect caller list, wherein the duration associated with the suspect caller is set to a first duration;
• extending the duration associated with the suspect caller when the suspect caller is already identified in the suspect caller list;
• and
• block incoming calls from suspect callers in the suspected caller list until the expiration of the duration associated with the suspect caller.

A system, comprising:

• one or more processors;
• and
• a memory device coupled to the one or more processors, the memory device storing computer-readable instructions that, upon execution by the one or more processors, cause the system to:
• monitor incoming calls directed towards an enterprise calling system that is provided IP telephony calling by the IP telephony network wherein each incoming message originates from a sender, wherein the enterprise calling system is assigned a call capacity comprising a plurality of communication channels;
• monitor resource exhaustion within the enterprise calling system by monitoring a number of available communication channels from the plurality of communication channels assigned for use by the enterprise calling system within the IP telephony network;
• and
• enable a protection scheme when the resource exhaustion monitoring indicates the available call capacity has dropped below a first threshold, wherein the executed program instruction of the enabled protection scheme further cause the system to:
• identify a sender that has attempted to complete multiple incoming calls to the enterprise calling system;
• determine whether the sender is identified in a suspect caller list, wherein each suspect in the suspect caller list is associated with a duration;
• add the sender caller to a suspect caller list when the sender is not identified in the suspect caller list, wherein the duration associated with the sender is set to a first duration;
• extend the duration associated with the sender when the sender is already identified in the suspect caller list;
• and
• block incoming calls from suspect callers in the suspected caller list until the expiration of the duration associated with the sender.