Methods, systems, and computer readable media for validating location update messages

1. A method for validating location update request messages, the method comprising:

receiving, by a signaling firewall from a non-home network, an ingress location update request message related to a mobile subscriber;

querying a directional state database to obtain predicted country trajectory data associated with the mobile subscriber, wherein the predicted country trajectory data is utilized to identify a trajectory direction of a user equipment corresponding to the mobile subscriber that is used to indicate a predicted country that is a most probable destination for the user equipment, wherein the trajectory direction is identified using a plurality of mobility pattern window entries that is stored in the directional state database and indicates previous movement patterns of the user equipment, wherein the trajectory direction is identified using a plurality of location entries stored in the directional state database and assigning more weight to a most recent trajectory comprising a most recent three location entries of the plurality of location entries, wherein indicating the predicted country is based on a location of the predicted country relative to the trajectory direction, wherein indicating the predicted country is based on a determined level of confidence for the predicted country;

comparing the predicted country with country code information included in the ingress location update request message; and

validating the ingress location update request message if the predicted country and the country code information match.

2. The method of claim 1 comprising designating the ingress location update request message as suspicious if the predicted country trajectory data and the country code information are different.

3. The method of claim 1 wherein the ingress location update request message is a Diameter update location request (ULR) message or a SS7 location update request message.

4. The method of claim 1 wherein the signaling firewall includes a Diameter routing agent (DRA), a Diameter signaling router (DSR), a signal transfer point (STP), a security edge protection proxy (SEPP).

5. The method of claim 1 comprising sending, by the signaling firewall, an alert message to a network operator in response to determining that the predicted country trajectory data and the country code information are different.

6. The method of claim 1 comprising extracting a mobile country code (MCC) identifier from an international mobile subscriber identity (IMSI) included in the ingress location update request message to identify a country associated with the non-home network.

7. The method of claim 1 wherein the directional state database is provisioned with user equipment location information associated with the mobile subscriber.

8. The method of claim 7 wherein the user equipment location information includes at least one of cell identifier (CID), a location area code (LAC) identifier, or a sector identifier.

9. The method of claim 7 wherein the signaling firewall is configured to send Any Time Interrogation (ATI) messages to request the user equipment location information on a periodic basis, random basis, or preconfigured time interval.

10. A system for validating location update request messages, the system comprising:

a signaling firewall including at least one processor;

a directional state database local to the signaling firewall for storing location information related to a mobile subscriber; and

a security signaling engine stored in memory of the signaling firewall and implemented using the at least one processor for receiving from a non-home network an ingress location update request message related to a mobile subscriber, querying a directional state database to obtain predicted country trajectory data associated with the mobile subscriber, wherein the predicted country trajectory data is utilized to identify a trajectory direction of a user equipment corresponding to the mobile subscriber that is used to indicate a predicted country that is a most probable destination for the user equipment, wherein the trajectory direction is identified using a plurality of mobility pattern window entries that is stored in the directional state database and indicates previous movement patterns of the user equipment, wherein the trajectory direction is identified using a plurality of location entries stored in the directional state database and assigning more weight to a most recent trajectory comprising a most recent three location entries of the plurality of location entries, wherein indicating the predicted country is based on a location of the predicted country relative to the trajectory direction, wherein indicating the predicted country is based on a determined level of confidence for the predicted country, comparing the predicted country with country code information included in the ingress location update request message, and validating the ingress location update request message if the predicted country and the country code information match.

11. The system of claim 10 comprising designating the ingress location update request message as suspicious if the predicted country trajectory data and the country code information are different.

12. The system of claim 10 wherein the ingress location update request message is a Diameter update location request (ULR) message or an SS7 location update request message.

13. The system of claim 10 wherein the signaling firewall includes a Diameter routing agent (DRA), a Diameter signaling router (DSR), a signal transfer point (STP), a security edge protection proxy (SEPP).

14. The system of claim 10 comprising sending, by the signaling firewall, an alert message to a network operator in response to determining that the predicted country trajectory data and the country code information are different.

15. The system of claim 10 comprising extracting a mobile country code (MCC) identifier from an international mobile subscriber identity (IMSI) included in the ingress location update request message to identify a country associated with the non-home network.

16. The system of claim 10 wherein the directional state database is provisioned with user equipment location information associated with the mobile subscriber.

17. The system of claim 16 wherein the user equipment location information includes at least one of cell identifier (CID), a location area code (LAC) identifier, or a sector identifier.

18. The system of claim 16 wherein the signaling firewall is configured to send Any Time Interrogation (ATI) messages to request the user equipment location information on a periodic basis, random basis, or preconfigured time interval.

19. A non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer controls the computer to perform steps comprising:

receiving, by a signaling firewall from a non-home network, an ingress location update request message related to a mobile subscriber;

querying a directional state database to obtain predicted country trajectory data associated with the mobile subscriber, wherein the predicted country trajectory data is utilized to identify a trajectory direction of a user equipment corresponding to the mobile subscriber that is used to indicate a predicted country that is a most probable destination for the user equipment, wherein the trajectory direction is identified using a plurality of mobility pattern window entries that is stored in the directional state database and indicates previous movement patterns of the user equipment, wherein the trajectory direction is identified using a plurality of location entries stored in the directional state database and assigning more weight to a most recent trajectory comprising a most recent three location entries of the plurality of location entries, wherein indicating the predicted country is based on a location of the predicted country relative to the trajectory direction, wherein indicating the predicted country is based on a determined level of confidence for the predicted country;

comparing the predicted country with country code information included in the ingress location update request message;

validating the ingress location update request message if the predicted country and the country code information match; and

designating the ingress location update request message as suspicious if the predicted country and the country code information are different.

20. The non-transitory computer readable medium of claim 19 comprising designating the ingress location update request message as suspicious if the predicted country trajectory data and the country code information are different.