Signaling Firewall Location Validation Through Call Intelligence
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing signaling firewalls in mobile communications networks face challenges in implementing effective velocity checks due to the labor-intensive process of generating databases for travel times between cities, leading to difficulties in validating location update signaling messages and preventing malicious actors from redirecting traffic.
Innovation Solution
A system that collects call session data from mobile devices, extracts current location and timestamp data from update location requests, and uses a security analytics engine with machine learning to validate the location by comparing this data with stored call session data, allowing or rejecting the request based on assessment results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a signaling firewall uses a velocity check mechanism with a database of travel times between cities to validate location update messages, then the ability to detect malicious traffic redirection is improved, but the complexity and labor intensity of generating and maintaining the database increases significantly
Solution Approach 1:
A security analytics engine is introduced as an intermediary component between the signaling firewall and the velocity check database. This engine automatically generates the velocity check database by analyzing historical call session data and determining realistic travel times between locations, thereby eliminating the manual labor of database creation while providing accurate velocity check data to the signaling firewall for validating location update messages
2Reliability
If a signaling firewall implements a velocity check mechanism with comprehensive travel time data, then the detection of fictitious network locations is improved, but the provisioning process becomes too labor-intensive for customers to implement
Solution Approach 1:
The system implements self-service by enabling the security analytics engine to automatically generate and maintain the velocity check database using historical call session data from the network. This automated approach eliminates the need for customer personnel to manually provision travel time data, making the malicious actor detection capability accessible without requiring specialized labor-intensive provisioning efforts
3Measurement precision
If call session data is collected and analyzed using machine learning to perform velocity checks, then the accuracy of location validation is improved, but the computational resources and processing time required increase
Solution Approach 1:
The system performs preliminary action by pre-calculating and storing velocity check data in a database during periods when call session data is naturally available. The security analytics engine processes historical data to determine travel times between locations and stores this information in advance, so that when location update messages need validation, the pre-computed velocity check data can be quickly retrieved and applied without requiring real-time machine learning computation
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for providing call intelligence to a signaling firewall in a communications network includes collecting, by a network security service component, call session data from incoming and outgoing calls involving a mobile device and providing, by the network security service component, the call session data to a signaling firewall via an application programming interface (API). The method further includes receiving, by the signaling firewall, an update location request message associated with the mobile device, extracting signaling message information that includes current location data and timestamp data from the received update location request message, and utilizing the current location data and the timestamp data to identify a correlated portion of the call session data. The method further includes providing the signaling message information and the correlated portion of the call session data to a security analytics engine platform for a location validation assessment and allowing or rejecting, by the signaling firewall, the update location request message based on location validation assessment data received from the security analytics engine platform.