Unsupervised spoofing detection from traffic data in mobile networks

1. A computer-implemented method executed on a processor for detecting spoofing attacks from network traffic log data, the method comprising:

training a spoofing attack detector with the network traffic log data received from one or more mobile networks by:

extracting features that are relevant to spoofing attacks for training data;

building a first set of vector representations for the network traffic log data;

training an anomaly detection model by employing a deep auto-encoding Gaussian mixture model (DAGMM);

obtaining learned parameters of DAGMM; and

storing the learned parameters in a database;

wherein the extracted features include a number of unmatched

“InvokeSendAuthenticationInfo” logs, a number of unmatched

“InvokeUpdateGprsLocation” logs, a number of unmatched

“InvokeSendRoutingInfoForSM” logs, a number of unmatched “InvokeMtForwardSM” logs, a number of pairs of “InvokeInsertSubscriberData” logs that share similar global title (GT) information, and a number of pairs of “InvokeMoForwardSM” logs that share similar GT information.

2. The method of claim 1 , further comprising:

testing the spoofing attack detector with the network traffic log data received from the one or more mobile networks by:

extracting features that are relevant to spoofing attacks for testing data;

building a second set of vector representations for the network traffic log data;

obtaining latent representations of the testing data by the learned model from the training phase;

computing a z-score of the testing data based on the latent representations of the testing data; and

creating a spoofing attack alert report listing traffic logs generating z-scores exceeding a predetermined threshold.

3. The method of claim 1 , wherein the learned parameters include a first set of parameters from a deep auto-encoder and a second set of parameters from a Gaussian mixture model (GMM).

4. The method of claim 3 , wherein the first set of parameters enable projection of the network traffic log data from their feature space to a compact latent space and the second set of parameters enable evaluation of whether a group of traffic logs are anomalous in terms of spoofing attack related features.

5. The method of claim 1 , wherein the spoofing attack alert report includes a start time and an end time of a log group, and the generated alerts are stored in an alert database.

6. The method of claim 1 , wherein the trained anomaly detection model evaluates similarities and dissimilarities of the training data.

7. The method of claim 1 , wherein the testing data is partitioned into a first set of groups and the testing data is partitioned into a second set of groups.

8. A non-transitory computer-readable storage medium comprising a computer-readable program for detecting spoofing attacks from network traffic data, wherein the computer-readable program when executed on a computer causes the computer to perform the steps of:

training a spoofing attack detector with the network traffic log data received from one or more mobile networks by:

extracting features that are relevant to spoofing attacks for training data;

building a first set of vector representations for the network traffic log data;

training an anomaly detection model by employing a deep auto-encoding Gaussian mixture model (DAGMM);

obtaining learned parameters of DAGMM; and

storing the learned parameters in a database,

wherein the extracted features include a number of unmatched

“InvokeSendAuthenticationInfo” logs, a number of unmatched

“InvokeUpdateGprsLocation” logs, a number of unmatched

“InvokeSendRoutingInfoForSM” logs, a number of unmatched “InvokeMtForwardSM” logs, a number of pairs of “InvokeInsertSubscriberData” logs that share similar global title (GT) information, and a number of pairs of “InvokeMoForwardSM” logs that share similar GT information.

9. The non-transitory computer-readable storage medium of claim 8 , wherein the computer-readable program when executed on a computer causes the computer to perform the steps of:

testing the spoofing attack detector with the network traffic log data received from the one or more mobile networks by:

extracting features that are relevant to spoofing attacks for testing data;

building a second set of vector representations for the network traffic log data;

obtaining latent representations of the testing data by the learned model from the training phase;

computing a z-score of the testing data based on the latent representations of the testing data; and

creating a spoofing attack alert report listing traffic logs generating z-scores exceeding a predetermined threshold.

10. The non-transitory computer-readable storage medium of claim 8 , wherein the learned parameters include a first set of parameters from a deep auto-encoder and a second set of parameters from a Gaussian mixture model (GMM).

11. The non-transitory computer-readable storage medium of claim 10 , wherein the first set of parameters enable projection of the network traffic log data from their feature space to a compact latent space and the second set of parameters enable evaluation of whether a group of traffic logs are anomalous in terms of spoofing attack related features.

12. The non-transitory computer-readable storage medium of claim 8 , wherein the spoofing attack alert report includes a start time and an end time of a log group, and the generated alerts are stored in an alert database.

13. The non-transitory computer-readable storage medium of claim 8 , wherein the trained anomaly detection model evaluates similarities and dissimilarities of the training data.

14. The non-transitory computer-readable storage medium of claim 8 , wherein the testing data is partitioned into a first set of groups and the testing data is partitioned into a second set of groups.