Isolated Telco Slices for Real-Time Malicious Traffic Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile network operators face challenges in efficiently detecting and responding to malicious activities within their vast networks due to the complexity of managing traffic for millions of users, which complicates real-time data extraction, correlation, and analysis, especially when threat actors exploit sensitive subscriber information.
Innovation Solution
Implementing isolated telecommunication functions that monitor network functions for malicious activity, create custom-built isolated network slices in real-time to isolate suspicious traffic, and analyze it efficiently, allowing for tailored responsive actions based on the nature of the threat.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the MNO monitors all network functions for malicious activity in the vast network, then security detection capability is improved, but system complexity and data processing burden increase significantly
Solution Approach 1:
The patent segments the large-scale network monitoring system into distributed network function monitors that independently monitor specific network functions. Each monitor captures security events locally, and results are aggregated by a security orchestrator. This segmentation reduces central system complexity while maintaining comprehensive security detection across the entire network.
2Measurement precision
If the MNO captures and analyzes traffic from all users in real-time, then malicious activity detection is improved, but data processing time and computational resources increase
Solution Approach 1:
The patent extracts only the security-relevant data and events from the vast network traffic using distributed monitors at network function levels. Instead of analyzing all user traffic centrally, the system extracts security events locally and sends only these extracted events to the security orchestrator for correlation and analysis, dramatically reducing data processing time while maintaining detection accuracy.
3Reliability
If the MNO creates isolated network slices for each threat, then security containment is improved, but network management complexity increases
Solution Approach 1:
The patent implements dynamic network slicing where isolated network slices are created on-demand when threats are detected, and automatically dissolved when threats are mitigated. The security orchestrator dynamically provisions slices based on real-time threat assessment, ensuring security containment while minimizing long-term network management complexity through automated lifecycle management.
4Reliability
If the MNO responds to each malicious activity individually, then security response effectiveness is improved, but response time and operational overhead increase
Solution Approach 1:
The patent merges multiple security events and threats through correlation analysis performed by the security orchestrator. By combining related events and identifying attack patterns across multiple sources, the system can respond to coordinated attacks as unified incidents rather than individual events, improving response effectiveness while reducing operational overhead through consolidated response actions.
Data Source
AI summary
Solutions are disclosed that provide isolated telecommunication (telco) functions for enhanced security monitoring and analysis. Examples monitor a plurality of network functions (NFs) of a wireless network for indications of malicious activity, such as mobility management entities (MMEs), user plane functions (UPFs), authentication server functions (AUSFs), and others. When suspected malicious activity is detected from a user equipment (UE), an isolated telco stack (i.e., an isolated network slice) is stood up in real-time to isolate the traffic to/from the UE. This facilitates capturing and analyzing the traffic, so that a responsive action may be selected. The configuration of the isolated telco stack (i.e., the NFs included in the isolated network slice) may be customized based on the nature of the suspected malicious activity. For example, suspected data exfiltration will trigger a first configuration, whereas suspected denial service will trigger a different configuration.