Detecting aggressive or attacking behaviors in ims sip signaling

A method comprising:

• receiving, at a transceiver of a network entity, a first request from a user equipment (UE);
• sending, at the transceiver, a first response to the UE;
• starting, at a processor of the network entity, a guard timer in response to the first request;
• incrementing, at a processor, a guard counter by one in response to the first request;
• receiving, at the transceiver, a second request from the UE;
• incrementing, at the processor, the guard counter by one in response to the second request;
• determining, at the processor, whether the guard counter has been exceeded and whether the guard timer has expired;
• and either:
• sending, at the transceiver, a second reply to the UE in response to the second request when the guard counter has not been exceeded or the guard timer has expired;
• or
• deleting, with the processor, the second request when the guard counter has been exceeded and the guard counter has not expired.

A network entity comprising:

• a transceiver to send and receive wired transmissions, wireless transmissions, or both wired transmissions and wireless transmissions;
• memory storing at least a signal monitoring application;
• and
• a processor in communication with at least the transceiver and the memory, the signal monitoring application including computer-executable instructions to cause the processor to:
• receive, at the transceiver, a first request from a user equipment (UE);
• send, at the transceiver, a first response to the UE;
• start, at the processor, a guard timer in response to receiving the first request;
• receive, at the transceiver, a second request from the UE;
• determine, at the processor, whether the guard timer has expired;
• and either:
• send, at the transceiver, a second reply to the UE in response to the second request when the guard timer has expired;
• or
• delete, at the processor, the second request when the guard timer has not expired.