System and method for detecting malicious attacks in a telecommunication network
The solution introduces a method and system in a network node of a telecommunication network such as the MME. The method includes receiving, from an eNodeB, an attach request that originated from a UE, the attach request including an identifier associated with a subscriber of the UE; checking a UE blacklist to determine whether the identifier in the attach request is on the UE blacklist; in response to the UE identifier being on the UE blacklist: rejecting the attach request; updating a success rate metric to reflect the failed attach request; comparing the success rate metric to a threshold; and in response to a decrease in the success rate metric below the threshold, recognizing a malicious attack and taking mitigating steps.
1. A method for execution in a network node of a telecommunication network comprising:
storing on a mobility management entity (MME) a blacklist of identifiers of user equipment (UE);
receiving, from an eNodeB, an attach request of a telecommunication process that originated from a UE, the attach request including an identifier associated with a subscriber of the UE;
upon receiving the attach request, using the MME to check a UE blacklist to determine whether the identifier is on the UE blacklist;
in response to the UE identifier being on the UE blacklist:
rejecting the attach request;
updating an attach success rate metric for the eNodeB to reflect the failed attach request;
comparing the updated attach success rate metric for the eNodeB reflecting the failed attach request to a threshold; and
terminating the telecommunication process, without notifying a home subscriber server (HSS) at any time after the receiving of the attach request from the eNodeB;
in response to the updated attach success rate metric for the eNodeB reflecting the failed attach request falling below the threshold, recognizing a malicious attack and taking mitigating steps; and in response to the UE identifier being absent from the UE blacklist:
requesting for further authentication of the UE identifier;
in response to failed authentication, rejecting the attach request and updating the attach success rate metric for the eNodeB to reflect the failed attach request;
comparing the attach success rate metric for the eNodeB to a threshold; and
in response to a decrease in the attach success rate metric for the eNodeB below the threshold, recognizing a malicious attack and taking mitigating steps.
2. The method of claim 1 , wherein taking mitigating steps comprises sending a message to the eNodeB to block one or more of the selected future attach requests.
3. The method of claim 1 , wherein the MME comprises an eNodeB blacklist.
4. The method of claim 1 , wherein taking mitigating steps comprises sending an overload start message to the eNodeB to block all future non-emergency attach requests.
5. The method of claim 1 , wherein taking mitigating steps comprises sending a shutdown message to the eNodeB to block all future attach requests.
6. The method of claim 1 , further comprising:
in response to the UE identifier being on the blacklist, tracking a number of attach request failures associated with the UE identifier; and
in response to the number of attach request failures exceeding a UE failure threshold, adding the UE identifier to the UE blacklist.
7. The method of claim 1 , further comprising:
receiving, from the eNodeB, a setup request including an identifier associated with the eNodeB;
checking a global list to determine whether the eNodeB identifier is on the global list;
in response to the eNodeB identifier being on the global list, responding with a setup response to the eNodeB; and
in response to the eNodeB identifier being one or more of absent from the global list and on an eNodeB blacklist, responding with a setup failure to the eNodeB.
8. The method of claim 7 , wherein responding with a setup failure to the eNodeB further comprises including a Time to Wait information element specifying a time period that the eNodeB must wait before sending another setup request.
9. The method of claim 7 , further comprising:
storing the eNodeB blacklist on the MME.
10. The method of claim 9 , further comprising maintaining the eNodeB blacklist to include identifiers associated with eNodeBs involved in past malicious attacks.
11. The method of claim 1 , further comprising maintaining the UE blacklist to include identifiers associated with stolen UEs and UEs involved in past malicious attacks.
12. The method of claim 9 , wherein the MME performs the steps of:
checking the global list; and
checking the eNodeB blacklist.
13. A telecommunication network node comprising:
an S1 interface configured to receive an attach request of a telecommunication process from an eNodeB, the attach request including an identifier associated with a subscriber of the UE;
a memory configured to store a UE blacklist and an attach success rate metric on a per eNodeB basis; and
a processor configured to:
upon receiving the attach request, check the UE blacklist to determine whether the UE identifier in the attach request is on the UE blacklist;
in response to the UE identifier being on the UE blacklist:
reject the attach request;
update a success rate metric for the eNodeB to reflect the failed attach request;
compare the updated attach success rate metric for the eNodeB reflecting the failed attach request to a threshold; and
terminate the telecommunication process, without notifying a home subscriber server (HSS) at any time after the receiving of the attach request from the eNodeB; and
in response to the updated attach success rate metric for the eNodeB reflecting the failed attach request falling below the threshold, recognize a malicious attack and taking mitigating steps; and
in response to the UE identifier being absent from the UE blacklist:
request for further authentication of the UE identifier;
in response to failed authentication, reject the attach request and updating the attach success rate metric on the telecommunication network node on the per eNodeB basis to reflect the failed attach request;
compare the attach success rate metric for the eNodeB to a threshold; and
in response to a decrease in the success rate metric below the threshold, recognize a malicious attack and taking mitigating steps.
14. The network node of claim 13 , wherein the processor is further configured to send a message to the eNodeB to block one of all or selected future attach requests.
15. The network node of claim 13 , wherein the processor is further configured to send an overload start message to the eNodeB to block all future non-emergency attach requests.
16. The network node of claim 13 , wherein the processor is further configured to send a shutdown message to the eNodeB to block all future attach requests.
17. The network node of claim 13 , wherein the processor is further configured to:
in response to the UE identifier being on the blacklist, track a number of attach failures associated with the UE identifier; and
in response to the number of attach failures exceeding a UE failure threshold, add the UE identifier to the UE blacklist.
18. The network node of claim 13 , wherein the processor is further configured to:
receive, from the eNodeB, a setup request including an identifier associated with the eNodeB;
check a global list to determine whether the eNodeB identifier is on the global list;
in response to the eNodeB identifier being on the global list, respond with a setup response to the eNodeB; and
in response to the eNodeB identifier being one or more of absent from the global list and on an eNodeB blacklist, respond with a setup failure to the eNodeB.
19. The network node of claim 18 , wherein the processor is further configured to send a setup failure including a Time to Wait information element specifying a time period that the eNodeB must wait before sending another setup request.
20. The network node of claim 18 , wherein the memory is further configured to store the eNodeB blacklist.
21. The network node of claim 18 , wherein the memory is further configured to maintain the eNodeB blacklist to include identifiers associated with eNodeBs involved in past malicious attacks.
22. The network node of claim 13 , wherein the processor is configured to request for further authentication of the UE identifier by the Home Subscriber Server (HSS) via an S6a interface.
23. A security method for execution in a Mobility Management Entity (MME) node of a telecommunication network to detect malicious attacks, comprising:
storing on the MME a UE blacklist of identifiers of user equipment (UE);
receiving, from an eNodeB, an attach request of a telecommunication process that originated from a UE, the attach request including an identifier associated with a subscriber of the UE;
checking the UE blacklist to determine whether the identifier in the attach request is on the UE blacklist;
in response to the UE identifier being on the UE blacklist.
rejecting the attach request;
sending an attach reject message back to the eNodeB;
terminating the telecommunication process, without notifying a home subscriber server (HSS) at any time after the receiving of the attach request from the eNodeB;
updating an attach success rate metric for the eNodeB to reflect the failed attach request; and
in response to the updated attach success rate metric for the eNodeB reflecting the failed attached request falling below a threshold, recognizing a malicious attack and taking mitigating steps.
24. The security method of claim 23 , further comprising:
in response to the UE identifier being absent from the UE blacklist:
requesting for further authentication of the UE identifier;
in response to failed authentication, rejecting the attach request and updating the success rate metric to reflect the failed attach request;
comparing the attach success rate metric for the eNodeB to a threshold; and
in response to a significant decrease in the attach success rate metric for the eNodeB, recognizing a malicious attack and taking mitigating steps.
25. The security method of claim 23 , further comprising:
in response to the UE identifier being absent from the UE blacklist:
requesting further authentication of the UE identifier;
in response to failed authentication, rejecting the attach request and updating the attach success rate metric for the eNodeB to reflect the failed attach request;
comparing the attach success rate metric for the eNodeB to a threshold; and
in response to a significant decrease in the success rate metric, recognizing a malicious attack and taking mitigating steps.
26. The security method of claim 23 , wherein taking mitigating steps comprises sending a message to the eNodeB to block one or more of the selected future attach requests.
27. The security method of claim 23 , wherein taking mitigating steps comprises sending an overload start message to the eNodeB to block all future non-emergency attach requests.
28. The security method of claim 23 , wherein taking mitigating steps comprises sending a shutdown message to the eNodeB to block all future attach requests.
29. The security method of claim 23 , further comprising:
in response to the UE identifier being on the blacklist, tracking a number of attach request failures associated with the UE identifier; and
in response to the number of attach request failures exceeding a UE failure threshold, adding the UE identifier to the UE blacklist.
30. The security method of claim 23 , further comprising:
receiving, from the eNodeB, a setup request including an identifier associated with the eNodeB;
checking a global list o determine whether the eNodeB identifier is on the global list;
checking an eNodeB blacklist to determine whether the eNodeB identifier is on the eNodeB blacklist;
in response to the eNodeB identifier being on the global list and not on the eNodeB blacklist, responding with a setup response to the eNodeB; and
in response to the eNodeB identifier being one or more of absent from the global list and not the eNodeB blacklist, responding with a setup failure to the eNodeB.
31. The security method of claim 30 , wherein responding with a setup failure to the eNodeB further comprises including a Time to Wait information element specifying a time period that the eNodeB must wait before sending another setup request.
32. The security method of claim 30 , further comprising:
maintaining the eNodeB blacklist on the MME node.
33. The security method of claim 32 , further comprising maintaining the eNodeB blacklist to include identifiers associated with eNodeBs involved in past malicious attacks.
34. The security method of claim 23 , further comprising maintaining the UE blacklist to include identifiers associated with stolen UEs and UEs involved in past malicious attacks.
35. The security method of claim 23 , further comprising comparing the attach success rate metric for the eNodeB to at least one of an absolute threshold or a relative threshold to recognize a significant decrease in the attach success rate metric.