Method and apparatus for detecting diameter protocol IDR message spoofing attack in mobile communication network

A method of detecting a Diameter spoofing attack using a message of a GTP-C protocol, the method comprising:

• obtaining a normal IMSI from a Create Session Request message of a General Packet Radio Service (GPRS) Tunneling Protocol for Control plane (GTP-C) protocol generated by an MME;
• obtaining a first tunnel ID (Tunnel Endpoint Identifier (TEID)) from a Create Session Response message transmitted in response to the Create Session Request message, the first tunnel ID being a S11 Serving GateWay (SGW) GTP-C TEID;
• adding a record comprising the first tunnel ID and the normal IMSI to a session table;
• obtaining a second tunnel ID (TEID) included in a Delete Session Request message of the GTP-C protocol generated by the MME, the second tunnel ID being a S11 SGW GTP-C TEID, the Delete Session Request message not including an IMSI;
• deleting a record comprising the second tunnel ID included in the Delete Session Request message from the session table;
• obtaining an IDR message of a Diameter S6a protocol;
• and
• determining that the IDR message of the Diameter S6a protocol is an abnormal IDR message based on an IMSI included in the IDR message not being found in the session table, the session table not including information obtained from a packet of a Diameter S6a protocol.

A fifth generation (5G) mobile communication system comprising:

• a 5G core network which comprises a packet tapper in a virtual switch;
• an abnormal packet detection system which analyzes a packet obtained through the packet tapper,
• wherein the abnormal packet detection system is configured to:
• obtain a first normal IMSI from a packet of a Diameter S6a protocol transmitted from an MME to an HSS of a home network and add a record comprising the first normal IMSI to a first session table;
• obtain a second normal IMSI from a Create Session Request message packet of a GTP-C protocol generated by the MME and add a record comprising the second normal IMSI to a second session table, and
• based on an IDR message of the Diameter S6a protocol being included in the packet obtained through the packet tapper,
• determine the IDR message to be an abnormal IDR message based on an IMSI included in the IDR message being found in none of the first session table and the second session table, otherwise determine the IDR message to be a dangerous IDR message based on an IMSI included in the IDR message being found in either one of the first session table and the second session table.