Methods and apparatus for intrusion protection in systems that monitor for improper network usage

An apparatus to protect a service platform, the apparatus comprising:

• a transaction monitor to detect responses from the service platform indicative of questionable signaling protocol transactions;
• a transaction cache to store transaction records corresponding to the questionable signaling protocol transactions, at least one of the transaction records to identify a signaling protocol message and an associated first originating device address corresponding to a respective questionable transaction;
• and
• an intrusion detection engine to monitor a user identifier for a first threshold number of Session Initiation Protocol requests when the user identifier is associated with only the first originating device address, to monitor the user identifier for a second threshold number of Session Initiation Protocol requests when the user identifier is associated with the first originating device address at a first time and a second originating device address at a second time, and to generate a response indicating that the first originating device address is associated with an improper intrusion of the service platform.

A tangible machine readable storage device comprising instructions which, when executed, cause a machine to perform operations comprising:

• detecting responses from a service platform indicative of questionable signaling protocol transactions;
• storing transaction records corresponding to the questionable signaling protocol transactions, at least one of the transaction records identifying a signaling protocol message and an associated first originating device address corresponding to a respective questionable transaction;
• monitoring a user identifier for a first threshold number of Session Initiation Protocol requests when the user identifier is associated with only the first originating device address;
• monitoring the user identifier for a second threshold number of Session Initiation Protocol requests when the user identifier is associated with the first originating device address at a first time and a second originating device address at a second time;
• and
• generate a response indicating that the first originating device address is associated with an improper intrusion of the service platform.