# US 9,438,641 B2 · State machine profiling for voice over IP calls > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,438,641 B2 - Document ID: US9438641B2 - Status: Granted - Kind: B2 - Application number: 12/115,196 - Filed: 2008-05-05 - Published: 2009-11-05 - Granted: 2016-09-06 - Earliest claimed: 2008-05-05 - Assignees: Avaya Inc. - Applicants: Navjot Singh; Akshay Adhikari; Yu-Sung Wu - Inventors: Sachin Garg; Navjot Singh; Akshay Adhikari; Yu-Sung Wu - Web page: https://patentgrep.com/patent/US9438641B2 ## CPC - H04L 65/1079: {of unsolicited session attempts, e.g. SPIT} - H04M 3/436: Arrangements for screening incoming calls {, i.e. evaluating the characteristics of a call before deciding whether to answer it (based on the calling party profile H04M3/42059; based on location H04M3/42348; based on presence H04M3/42365; diversion H04M3/54)} - H04L 51/212: using filtering or selective blocking - H04M 2201/18: Comparators - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04M: TELEPHONIC COMMUNICATION (circuits for controlling other apparatus via a telephone cable and not involving telephone switching apparatus G08) ## Abstract An apparatus and method for detecting potentially-improper call behavior (e.g., SPIT, etc.) are disclosed. The illustrative embodiment of the present invention is based on finite-state machines (FSMs) that represent the legal states and state transitions of a communications protocol at a node during a Voice over Internet Protocol (VoIP) call. In accordance with the illustrative embodiment, a library of FSM execution profiles associated with improper call behavior is maintained. When there is a match between the behavior of a finite-state machine during a call and an execution profile in the library, an alert is generated. ## Claims ### Claim 1 A method comprising: generating, by a data-processing system, one or more execution profiles of a finite-state machine; generating, by the data-processing system, one or more rules that characterize a relationship among the execution of multiple finite-state machines or among one or more finite-state machines across a plurality of calls, wherein a rule in the one or more rules comprises one or more of an identity of a caller, an identity of a called party, and a calling time; building, by the data-processing system, a data store that comprises the one or more execution profiles and is for matching against an execution of an instance of the finite-state machine during a call; and building, by the data-processing system, a data store that comprises the one or more rules and is for matching against the execution of the multiple finite-state machines or against the one or more finite-state machines across the plurality of calls; wherein the finite-state machine corresponds to a state of a communications protocol at a node, wherein at least one of the execution profiles is associated with improper call behavior, wherein the execution profiles associated with improper call behavior comprise one or more of an identity of a caller, an identity of a called party, a and calling time, wherein at least one of the execution profiles comprises a metric that is based on how often the finite-state machine visits one or more particular states; and wherein at least one of the execution profiles comprises a metric that is based on how long the finite-state machine spends in one or more particular states. ### Claim 2 (depends on 1) The method of claim 1 wherein at least one of the execution profiles is based on empirical data for one or more prior calls. ### Claim 3 (depends on 1) The method of claim 1, wherein the improper call behavior is Spam over Internet Telephony. ### Claim 4 (depends on 1) The method of claim 1, wherein at least one of the execution profiles comprises a sequence of visited states of the finite-state machine. ### Claim 5 (depends on 1) The method of claim 1, wherein the call is a Voice over Internet Protocol call, and wherein the communications protocol is one of Session Initiation Protocol and Real-time Transport Protocol. ### Claim 6 A method comprising: receiving, by a server of a call-monitoring system, a notification related to a behavior of a finite-state machine during a call, wherein the finite-state machine corresponds to a state of a communications protocol at a node and wherein the behavior comprises at least one state transition of the communications protocol at the node; comparing, by the server of the call-monitoring system, the behavior of the finite-state machine to a plurality of execution profiles, wherein one or more of the execution profiles comprise one or more of an identity of a caller, an identity of a called party, and a calling time; when the behavior of the finite-state machine matches at least one of the plurality of execution profiles, generating, by the server of the call-monitoring system, a first signal that indicates a first possible occurrence of improper call behavior; and when the behavior of the finite-state machine does not match at least one of the plurality of execution profiles: comparing, by the server of the call-monitoring system, the behavior of the finite-state machine to a plurality of rules, wherein one or more of the rules comprise one or more of an identity of a caller, an identity of a called party, and a calling time; and generating, by the server of the call-monitoring system, a second signal that indicates a second possible occurrence of improper call behavior when the behavior of the finite state machine matches at least one of the plurality of rules. ### Claim 7 (depends on 6) The method of claim 6, wherein the improper call behavior is Spam over Internet Telephony. ### Claim 8 (depends on 6) The method of claim 6, wherein the node is a first telecommunications terminal, and wherein the improper call behavior is engendered by a second telecommunications terminal. ### Claim 9 (depends on 6) The method of claim 6, wherein the call is a Voice over Internet Protocol call, and wherein the communications protocol is one of Session Initiation Protocol and Real-time Transport Protocol. ### Claim 10 (depends on 6) The method of claim 6, wherein at least one of the execution profiles comprises a sequence of visited states of the finite-state machine. ### Claim 11 (depends on 6) The method of claim 6, wherein at least one of the execution profiles comprises a metric that is based on how often the finite-state machine visits one or more particular states. ### Claim 12 (depends on 6) The method of claim 6, wherein at least one of the execution profiles comprises a metric that is based on how long the finite-state machine spends in one or more particular states. ### Claim 13 A call-monitoring system comprising: a server comprising a processor coupled to a memory, wherein the processor executes program code stored in the memory to: receive a notification related to a behavior of a finite-state machine during a call, wherein the finite-state machine corresponds to a state of a communications protocol at a node and wherein the behavior comprises at least one state transition of the communications protocol at the finite-state machine; compare the behavior of the finite-state machine to a plurality of execution profiles, wherein one or more of the execution profiles comprise one or more of an identity of a caller, an identity of a called party, and a calling time; when the behavior of the finite-state machine matches at least one of the plurality of execution profiles, generate a first signal that indicates a first possible occurrence of improper call behavior; and when the behavior of the finite-state machine does not match at least one of the plurality of execution profiles: compare the behavior of the finite-state machine to a plurality of rules, wherein one or more of the rules comprise one or more of an identity of a caller, an identity of a called party, and a calling time; and generate a second signal that indicates a second possible occurrence of improper call behavior when the behavior of the finite state machine matches at least one of the plurality of rules. ### Claim 14 (depends on 13) The call-monitoring system of claim 13, wherein the improper call behavior is Spam over Internet Telephony. ### Claim 15 (depends on 13) The call-monitoring system of claim 13, wherein the node is a first telecommunications terminal, and wherein the improper call behavior is engendered by a second telecommunications terminal. ### Claim 16 (depends on 13) The call-monitoring system of claim 13, wherein the call is a Voice over Internet Protocol call, and wherein the communications protocol is one of Session Initiation Protocol and Real-time Transport Protocol. ### Claim 17 (depends on 13) The call-monitoring system of claim 13, wherein at least one of the execution profiles comprises a sequence of visited states of the finite-state machine. ### Claim 18 (depends on 13) The call-monitoring system of claim 13, wherein at least one of the execution profiles comprises a metric that is based on how often the finite-state machine visits one or more particular states. ### Claim 19 (depends on 13) The call-monitoring system of claim 13, wherein at least one of the execution profiles comprises a metric that is based on how long the finite-state machine spends in one or more particular states.