MOBILE AWARE INTRUSION DETECTION SYSTEM
A method and system of detecting a source of an intrusion in a mobile network. A data packet is captured of a plane traffic of a user device that is using the mobile network. The data packet has a header portion and a payload. The payload is inspected for a security event. Upon determining a presence of the security event, a unique session identifier is extracted from the header portion of the data packet. A source of the security event is identified based on the extracted unique session identifier.
1 . An intrusion detection system for a mobile network, comprising:
a processor;
a network interface coupled to the one or more processors;
a storage device for content and programming;
a program stored in the storage device, wherein execution of the program by the processors configures the system to perform acts, comprising:
capturing a data packet of a plane traffic of a user device that is using the mobile network, wherein the data packet has a header portion and a payload;
inspecting the payload for a security event;
upon determining a presence of the security event:
extracting a unique session identifier from the header portion of the data packet; and
identifying a source of the security event based on the extracted unique session identifier.
2 . The intrusion detection system of claim 1 , wherein the unique session identifier of the data packet is at least one of a tunnel endpoint identifier (TEID) and an internet protocol (IP) address of the user device.
3 . The intrusion detection system of claim 1 , wherein execution of the program further configures the system to perform acts comprising: upon determining the presence of the security event, taking a corrective action.
4 . The intrusion detection system of claim 3 , wherein the corrective action includes sending a notification to at least one of:
an account holder of the user device;
a system administrator of the mobile network; and
the user device.
5 . The intrusion detection system of claim 3 , wherein the corrective action comprises isolating the user device by at least one of blocking traffic to and a traffic from the user device over the mobile network.
6 . The intrusion detection system of claim 1 , wherein identifying a source of the security event comprises:
sending a data inquiry packet comprising an indicia of the identified security event and the unique session identifier to a correlation system configured to correlate the unique session identifier with a unique mobile user identifier.
7 . The intrusion detection system of claim 1 , wherein identifying a source of the security event comprises:
sending the header portion and the payload of the data packet to a correlation system configured to correlate the unique session identifier with an account holder information of the user device; and
receiving an account holder information of the user device from the correlation system.
8 . The intrusion detection system of claim 1 , wherein determining a presence of the security event comprises: identifying at least one of: a botnet, a distributed denial of service (DDoS) attack, and malware.
9 . The intrusion detection system of claim 1 , wherein the system comprises:
a user plane analysis component configured to receive user plane traffic and to extract a unique session identifier from the header portion of the data packet;
a control plane analysis component configured to receive control plane user traffic and to inspect the payload for a security event; and
a correlation component configured to correlate the security event and the unique session identifier with a unique user information of the mobile network.
10 . The intrusion detection system of claim 9 , wherein:
the control plane analysis component is configured to capture control plane traffic on an S5, an S2b, and an S1-MME interface; and
the user plane component is configured to capture user plane traffic on an S2a, the S2b, an S3, an S4, a Gn, an S5, the S1-MME, an S11, and an S8 interface.
11 . The intrusion detection system of claim 9 , wherein the unique user information of the mobile network comprises at least one of an international mobile subscriber identity (IMSI), a mobile station international subscriber directory number (MSISDN), and an international mobile station equipment identity (IMEI).
12 . A non-transitory computer-readable medium having stored thereon a program which, when executed by a processor, cause the processor to perform a method of detecting a source of an intrusion in a mobile network, the method comprising:
capturing a data packet of a plane traffic of a user device that is using the mobile network, wherein the data packet has a header portion and a payload;
inspecting the payload for a security event;
upon determining a presence of the security event:
extracting a unique session identifier from the header portion of the data packet; and
identifying a source of the security event based on the extracted unique session identifier.
13 . The method of claim 12 , wherein the unique session identifier of the data packet is at least one of a tunnel endpoint identifier (TEID) and an internet protocol (IP) address of the user device.
14 . The method of claim 12 , further comprising upon determining the presence of the security event, taking a corrective action.
15 . The method of claim 14 , wherein the corrective action includes sending a notification to at least one of:
an account holder of the user device;
a system administrator of the mobile network; and
the user device.
16 . The method of claim 14 , wherein the corrective action comprises isolating the user device by at least one of blocking traffic to and a traffic from the user device over the mobile network.
17 . The method of claim 12 , wherein identifying a source of the security event comprises:
sending a data inquiry packet comprising an indicia of the identified security event and the unique session identifier to a correlation system configured to correlate the unique session identifier with a unique mobile user identifier.
18 . The method of claim 12 , wherein identifying a source of the security event comprises:
sending the header portion and the payload of the data packet to a correlation system configured to correlate the unique session identifier with an account holder information of the user device; and
receiving an account holder information of the user device from the correlation system.
19 . The method of claim 12 , wherein the program comprises:
a user plane analysis component configured to receive user plane traffic and to extract a unique session identifier from the header portion of the data packet;
a control plane analysis component configured to receive control plane user traffic and to inspect the payload for a security event; and
a correlation component configured to correlate the security event and the unique session identifier with a unique user information of the mobile network.
20 . The method of claim 19 , wherein:
the control plane analysis component is configured to capture control plane traffic on an S5, an S2b, and an S1-MME interface; and
the user plane component is configured to capture user plane traffic on an S2a, the S2b, an S3, an S4, a Gn, an S5, the S1-MME, an S11, and an S8 interface.