1. A method comprising: receiving session control messages; counting the session control messages of a same type having a same transaction identifier (ID); blocking the session control messages of the same type having the same transaction ID when the count exceeds a threshold number; and determining whether the blocked session control messages are associated with an anomalous event and, when the blocked session control messages are not associated with the anomalous event, increasing the threshold number.