Message flooding prevention in messaging networks

摘要

A message flooding prevention system (1) has multiple interceptors (2, 3, 4), each with an interceptor unit linked with an RCS server, and SMSC, or an MMSC. The interceptors (2, 3, 4) are connected to flood detect nodes (10) for receiving messages at a point in a communications network, extracting data from a message, generating at least one code from extracted data, and comparing the code or codes with one or more previous codes. The flood detect nodes (10) determine according to the comparison if the received message is suspected to be a flooding message and if so, performs code generation including hashing. The flood detect nodes (10) save the code to one of a set of database buckets (21), each bucket being associated with a code, and select a bucket according to the generated code, and increment a fill parameter of the selected bucket.

主权项

1. A messaging system comprising:
at least one message interceptor node having a processor and ports adapted to receive messages at a point in a communications network, at least one flood detect node, having a processor adapted to:
extract data from a message,generate at least one code from the extracted data by hashing, and save said code to a database,compare the code or codes with one or more previous codes, anddetermine according to the comparison if the received message is suspected to be a flooding message,wherein said processor is adapted to perform said comparing and processing steps by:
providing a set of a fixed number of data buckets, each said bucket having an associated code, a fill parameter value, a time stamp indicating the last time it was incremented, a leak rate indicating a decrease in the fill parameter with time, and an identifier of an associated flood detect algorithm,selecting a bucket according to the generated code,incrementing a fill parameter of the selected bucket,determining suspicion of flooding by executing the associated flood detection algorithm, andsaving flood-detection data to persistent memory if there is suspected flooding,wherein at least one flood detect node is adapted to perform a first level detection to select a fixed number of buckets, to execute said flood detection algorithm for each bucket to detect flooding, and to execute an empty/cleanest bucket selection algorithm to select a bucket for updating a count, and wherein at least one flood detect node is adapted to perform a second level detection only for those buckets whose activity during detection is above a certain threshold.