Distributed stateful intrusion detection for voice over IP

A method for intrusion detection with distributed stateful intrusion detection, comprising:

• receiving a Session Initiation Protocol (SIP) signal as an application-layer protocol signal at a receiver of a Voice Over Internet Protocol (VoIP) intrusion detection systems from a network;
• distributing the received application-layer protocol signal to a first finite-state machine and to a second finite-state machine;
• detecting, by a data processing system, that the application-layer protocol enters a first application-layer protocol state S1 at a first node at a first time;
• determining, by the data processing system, whether the application-layer protocol fails to enter a second application-layer protocol state S2 at a second node within δ seconds of the first time, wherein δ is a positive real number;
• and
• generating, by the data-processing system, an alert signal that indicates a potential intrusion in response to the determination,
• wherein said first application-layer protocol state corresponds a first finite-state machine for said protocol and said first node, and wherein said second application-layer protocol state corresponds to a second finite-state machine for said protocol and said second node,
• wherein transition to an application-layer protocol state is based upon communication of an application-layer protocol message, and
• wherein said data-processing system comprises hardware.