# US 8,752,174 B2 · System and method for VoIP honeypot for converged VoIP services > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,752,174 B2 - Document ID: US8752174B2 - Status: Granted - Kind: B2 - Application number: 12/978,858 - Filed: 2010-12-27 - Published: 2012-06-28 - Granted: 2014-06-10 - Earliest claimed: 2010-12-27 - Assignees: Avaya Inc. - Applicants: John F Buford; Venkatesh Krishnaswamy - Inventors: John F Buford; Venkatesh Krishnaswamy - Web page: https://patentgrep.com/patent/US8752174B2 ## CPC - H04M 7/006: {Networks other than PSTN/ISDN providing telephone service, e.g. Voice over Internet Protocol (VoIP) , including next generation networks with a packet-switched transport layer (H04L65/00 takes precedence; aspects not specific to the type of network H04M3/00; special services in those networks H04M3/42)} - H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment} - H04L 65/1069: Session establishment or de-establishment - H04L 65/1079: {of unsolicited session attempts, e.g. SPIT} - H04M 3/436: Arrangements for screening incoming calls {, i.e. evaluating the characteristics of a call before deciding whether to answer it (based on the calling party profile H04M3/42059; based on location H04M3/42348; based on presence H04M3/42365; diversion H04M3/54)} - H04M 3/5183: {Call or contact centers with computer-telephony arrangements} - H04L 63/02: {for separating internal from external traffic, e.g. firewalls} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04M 3/53308: {Message originator indirectly connected to the message centre, e.g. after detection of busy or absent state of a called party} - H04M: TELEPHONIC COMMUNICATION (circuits for controlling other apparatus via a telephone cable and not involving telephone switching apparatus G08) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Disclosed herein are systems, methods, and computer-readable storage media for a honeypot addressing cyber threats enabled by convergence of data and communication services in an enterprise network. Suspicious incoming VoIP calls from the Internet to the enterprise network are intercepted and directed to a VoIP honeypot that acts as a network decoy and responds automatically during call sessions for the suspicious incoming VOIP calls while tracing the suspicious incoming VOIP calls. Suspicious outgoing VoIP calls from the enterprise network to the Internet are also intercepted and directed to the VoIP honeypot. Moreover, an unsolicited VoIP call is redirected to the VoIP honeypot when the unsolicited VoIP call has been received by a user agent in the enterprise network and a human user of the user agent confirms that the unsolicited VoIP call was unsolicited. ## Claims ### Claim 1 A method comprising: establishing, at a voice over Internet protocol (VoIP) honeypot in a network, an occupancy schedule for a virtual user agent associated with the VoIP honeypot the VoIP honeypot acting as a decoy; intercepting an unsolicited incoming VoIP call to the network when the unsolicited incoming VoIP call is addressed to the virtual user agent; directing the unsolicited incoming VoIP call to a voice mailbox associated with the VoIP honeypot when the occupancy schedule indicates that the virtual user agent is unavailable when the unsolicited incoming VoIP call is received; and responding, at the VoIP honeypot, to the unsolicited incoming VoIP call during a call session while tracing the unsolicited incoming VoIP call. ### Claim 2 (depends on 1) The method of claim 1, wherein the unsolicited incoming VoIP call is directed to the voice mailbox when a human user confirms that the unsolicited incoming VoIP call is unsolicited. ### Claim 3 (depends on 1) The method of claim 1, further comprising responding, at a non-VoIP honeypot in the network, to a client sending a VoIP packet to the VoIP honeypot. ### Claim 4 (depends on 1) The method of claim 1, further comprising responding, at the VoIP honeypot, to a reference to a non-VoIP resource by sending a request, to a non-VoIP honeypot in the network, for access to the non-VoIP resource. ### Claim 5 (depends on 1) The method of claim 1, further comprising: detecting an unsolicited instant message; and directing the unsolicited instant message to an instant message honeypot that impersonates a human recipient of the instant message by composing and sending an instant message response to the instant message. ### Claim 6 (depends on 1) The method of claim 1, further comprising detecting that an outgoing VoIP call has been triggered by a user accessing a link contained in an unsolicited email, and directing the outgoing VoIP call to the VoIP honeypot. ### Claim 7 (depends on 1) The method of claim 1, wherein responding to the unsolicited incoming VoIP call comprises composing and returning a voice response that impersonates a human recipient. ### Claim 8 (depends on 1) The method of claim 1, further comprising identifying suspicious calls as originating from a common source of unsolicited calls, and compiling statistics of the suspicious calls to identify a call from an unknown source as being likely to have originated from the common source. ### Claim 9 A system comprising: a processor; and a computer-readable storage medium storing instructions which, when executed by the processor, cause the processor to perform operations comprising: establishing, at a voice over Internet protocol (VoIP) honeypot in a network, an occupancy schedule for a virtual user agent associated with the VoIP honeypot, the VoIP honeypot acting as a decoy; intercepting an unsolicited incoming VoIP call to the network when the unsolicited incoming VoIP call is addressed to the virtual user agent; directing the unsolicited incoming VoIP call to a voice mailbox associated with the VoIP honeypot when the occupancy schedule indicates that the virtual user agent is unavailable when the unsolicited incoming VoIP call is received; and responding, at the VoIP honeypot, to the unsolicited incoming VoIP call during a call session while tracing the unsolicited incoming VoIP call. ### Claim 10 (depends on 9) The system of claim 9, wherein the unsolicited incoming VoIP call is directed to the voice mailbox when a human user confirms that the unsolicited incoming VoIP call is unsolicited. ### Claim 11 (depends on 9) The system of claim 9, wherein the computer-readable storage medium stores additional instructions which, when executed by the processor, cause the processor to perform further operations comprising responding, at a non-VoIP honeypot in the network, to a client sending a VoIP packet to the VoIP honeypot. ### Claim 12 (depends on 9) The system of claim 9, wherein the computer-readable storage medium stores additional instructions which, when executed by the processor, cause the processor to perform further operations comprising responding, at the honeypot, to a reference to a non-VoIP resource by sending a request, to a non-VoIP honeypot in the network, for access to the non-VoIP resource. ### Claim 13 (depends on 9) The system of claim 9, wherein the computer-readable storage medium stores additional instructions which, when executed by the processor, cause the processor to perform further operations comprising: detecting an unsolicited instant message; and directing the unsolicited instant message to an instant message honeypot that impersonates a human recipient of the instant message by composing and sending an instant message response to the instant message. ### Claim 14 (depends on 9) The system of claim 9, wherein the computer-readable storage medium stores additional instructions which, when executed by the processor, cause the processor to perform further operations comprising detecting that an outgoing VoIP call has been triggered by a user accessing a link contained in an unsolicited email, and directing the outgoing VoIP call to the VoIP honeypot. ### Claim 15 (depends on 9) The system of claim 9, wherein responding to the unsolicited incoming VoIP call comprises composing and sending a voice response that impersonates a human recipient. ### Claim 16 (depends on 9) The system of claim 9, wherein the computer-readable storage medium stores additional instructions which, when executed by the processor, cause the processor to perform further operations comprising identifying suspicious calls as originating from a common source of unsolicited calls, and compiling statistics of the suspicious calls to identify a call from an unknown source as being likely to have originated from the common source. ### Claim 17 A computer-readable storage device storing instructions which, when executed by a processor, cause the processor to perform operations comprising: establishing, at a voice over Internet protocol (VoIP) honeypot in a network, an occupancy schedule for a virtual user agent associated with the VoIP honeypot the VoIP honeypot acting as a decoy; intercepting an unsolicited incoming VoIP call to the network when the unsolicited incoming VoIP call is addressed to the virtual user agent; directing the unsolicited incoming VoIP call to a voice mailbox associated with the VoIP honeypot when the occupancy schedule indicates that the virtual user agent is unavailable when the unsolicited incoming VoIP call is received; and responding, at the VoIP honeypot, to the unsolicited incoming VoIP call during a call session while tracing the unsolicited incoming VoIP call. ### Claim 18 (depends on 17) The computer-readable storage device of claim 17, wherein the unsolicited incoming VoIP call is directed to the voice mailbox when a human user confirms that the unsolicited incoming VoIP call is unsolicited.