System and method for responding to aggressive behavior associated with wireless devices
An embodiment of the invention describes a wireless device comprising a Subscriber Identity Module (SIM) further comprising a memory for storing program code for performing a plurality of operations, and a processor for processing the program code to execute the plurality of operations, the operations including receiving over-the-air instructions via a wireless network from a control center to create a rules set in the SIM, wherein the rules set defines an acceptable behavior of the wireless device, monitoring requests from a wireless modem of the wireless device for access files stored in the SIM, detecting an aggressive behavior of the wireless device based on the rules set, and blocking the wireless modem from generating traffic in the wireless network.
1. A system comprising a signal transfer point (STP) node for managing aggressive behavior of a wireless device in a wireless network, the STP node comprising:
a STP processor; and
a STP memory coupled with the STP processor to store a plurality of routing instructions, and to further store, on a per wireless device basis, a wireless device signature and a rule set, both of which are indexed by a wireless device identifier, wherein the wireless device signature defines an aggressive behavior of the wireless device that repeatedly retries to perform a network signaling in a time frame such that a threshold for the retries is exceeded, and wherein the routing instructions direct transmission of wireless device signals on a per wireless device basis, the STP memory configured to provide the STP processor with instructions which when executed cause the STP processor to perform STP operations to:
determine an aggressive behavior data of received wireless signals that are transmitted from the wireless device to the STP node;
determine the rule set for the received wireless signals, wherein the rule set comprises first logic to compare the wireless device signature to the aggressive behavior data of the received wireless signals, and second logic to provision one of the routing instructions in the STP memory;
identify, in accordance with the first logic in the rule set, presence of the aggressive behavior of the wireless device;
provision, in accordance with the second logic in the rule set, to modify the one of the routing instructions in the STP memory to control a transmission function of the STP node for the received wireless signals; and
perform real-time throttling, re-directing or blocking of the received wireless signals that are identified according to the first logic as aggressive behavior signals utilizing the one of the modified routing instructions provisioned in the STP memory.
2. The system of claim 1 , wherein the wireless device identifier is an International Mobile Subscriber Identity (IMSI) or an MSISDN.
3. The system of claim 1 , wherein the STP node identifies the aggressive behavior signals when the wireless device generates more than a threshold number of authentication failures per time unit.
4. The system of claim 1 , wherein the STP node identifies the aggressive behavior signals when the wireless device sends more than a threshold number of authentication requests in a time period towards a HLR.
5. The system of claim 1 , wherein the STP node identifies the aggressive behavior signals when the wireless device generates more than a threshold number of Packet Data GGSN Call Data Records (G-CDR) in a time period.
6. The system of claim 1 , wherein the rule set is adapted to different field behaviors of different categories of wireless devices.
7. The system of claim 1 , wherein the rule set specifies an allowable frequency and allowable successive number of times for the wireless device to retry for the network signaling.
8. A method utilizing a signal transfer point (STP) node for managing aggressive behavior of a wireless device in a wireless network, the method comprising:
providing the STP node comprising:
a STP processor; and
a STP memory coupled with the STP processor to store a plurality of routing instructions, and to further store, on a per wireless device basis, a wireless device signature and a rule set, both of which are indexed by a wireless device identifier, wherein the wireless device signature defines an aggressive behavior of the wireless device that repeatedly retries to perform a network signaling in a time frame such that a threshold for the retries is exceeded, and wherein the routing instructions direct transmission of wireless device signals on a per wireless device basis, the STP memory configured to provide the STP processor with instructions which when executed cause the STP processor to perform STP operations to:
determine an aggressive behavior data of received wireless signals that are transmitted from the wireless device to the STP node;
determine the rule set for the received wireless signals, wherein the rule set comprises first logic to compare the wireless device signature to the aggressive behavior data of the received wireless signals, and second logic to provision one of the routing instructions in the STP memory;
identify, in accordance with the first logic in the rule set, presence of the aggressive behavior of the wireless device;
provision, in accordance with the second logic in the rule set, to modify the one of the routing instructions in the STP memory to control a transmission function of the STP node for the received wireless signals; and
perform real-time throttling, re-directing or blocking of the received wireless signals that are identified according to the first logic as aggressive behavior signals utilizing the one of the modified routing instructions provisioned in the STP memory.
9. The method of claim 8 , wherein the wireless device identifier is an International Mobile Subscriber Identity (IMSI) or an MSISDN.
10. The method of claim 8 , wherein the STP node identifies the aggressive behavior signals when the wireless device generates more than a threshold number of authentication failures per time unit.
11. The method of claim 8 , wherein the STP node identifies the aggressive behavior signals when the wireless device sends more than a threshold number of authentication requests in a time period towards a HLR.
12. The method of claim 8 , wherein the STP node identifies the aggressive behavior signals when the wireless device generates more than a threshold number of Packet Data GGSN Call Data Records (G-CDR) in a time period.
13. The method of claim 8 , wherein the rule set is adapted to different field behaviors of different categories of wireless devices.
14. The method of claim 8 , wherein the rule set specifies an allowable frequency and allowable successive number of times for the wireless device to retry for the network signaling.