1. A method comprising: receiving session control messages; counting the session control messages of a first type and counting the session control messages of a second type, wherein the first type of session control messages and the second type of session control messages have a same transaction identifier (ID); blocking the session control messages of the first type having the same transaction ID when a count of the first type exceeds a first threshold number; blocking the session control messages of the second type having the same transaction ID when a count of the second type exceeds a second threshold number, wherein the first type is different than the second type and wherein the second threshold number is different than the first threshold number; determining whether the blocked session control messages are associated with an anomalous event and, when the blocked session control messages are not associated with the anomalous event, increasing the first threshold number or the second threshold number; counting, for each of a plurality of dialog IDs, a number of blocked session control messages; determining a distribution of the number of blocked session control messages across the plurality of dialog IDs; and changing the first threshold number or the second threshold number based on the distribution, wherein changing the first threshold number or the second threshold number based on the distribution includes: increasing the first threshold number or the second threshold number based on the distribution of the number of blocked session control messages across the plurality of dialog IDs when the distribution is a first distribution; and decreasing the first threshold number or the second threshold number based on the distribution of the number of blocked session control messages across the plurality of dialog IDs when the distribution is a second distribution, wherein the first distribution is broader than the second distribution.