Methods, systems, and computer readable media for detecting and mitigating effects of abnormal behavior of a machine type communication (MTC) device

A system for detecting and mitigating effects of abnormal machine type communication (MTC) device behavior, the system comprising:

• a telecommunications network node comprising one of a mobility management entity (MME), a Diameter routing agent (DRA), and a service capability exposure function (SCEF) and having at least one processor;
• and
• an MTC device behavior monitor comprising a component of the telecommunications network node and implemented by the at least one processor for receiving communication pattern (CP) information from which core network (CN) assistance information for tuning an evolved node B (eNB) to minimize MTC device state transitions is derivable, forwarding the CP information or the CN assistance information to another network node, deriving, from the CP information, a rule for uplink communications from the MTC device and storing the rule in memory of the telecommunications network node, monitoring the uplink communications from the MTC device, determining, during a first connectivity cycle of the MTC device and using the stored rule derived from the CP information, that the MTC device is not behaving in accordance with an expected behavior;
• and, in response to determining that the MTC device is not behaving in accordance with the expected behavior, incrementing, a count of incidents in which the MTC device is determined to violate the rule and determining that the count of incidents does not exceed a threshold defined for consecutive connectivity cycles of the MTC device, determining, during a second connectivity cycle of the MTC device and using the stored rule derived from the CP information, that the MTC device is not behaving in accordance with the expected behavior, incrementing the count of incidents, determining that the count exceeds the threshold, and, in response to determining that the count exceeds the threshold defined for consecutive connectivity cycles of the MTC device, performing a network security action that mitigates an effect of traffic from the MTC device on the network, wherein performing the network security action includes resetting the MTC device.

A non-transitory computer readable medium having stored thereon executable instructions that when executed by a processor of a computer controls the computer to perform steps comprising:

• at a telecommunications network node comprising one of a mobility management entity (MME), a Diameter routing agent (DRA), and a service capability exposure function (SCEF):
• receiving, by the telecommunications network node, communication pattern (CP) information from which core network (CN) assistance information for tuning an evolved node B (eNB) to minimize MTC device state transitions is derivable;
• forwarding, by the telecommunications network node, the CP information or the CN assistance information to another network node;
• deriving, by the telecommunications network node and from the CP information, a rule for policing uplink communications from the MTC device and storing the rule in memory of the telecommunications network node;
• monitoring, by the telecommunications network node, the uplink communications from the MTC device;
• determining, by the telecommunications network node, during a first connectivity cycle of the MTC device, and using the stored rule derived from the CP information, that the MTC device is not behaving in accordance with an expected behavior;
• and
• in response to determining that the MTC device is not behaving in accordance with the expected behavior, incrementing, by the telecommunications network node a count of incidents in which the MTC device is determined to violate the rule and determining that the count of incidents does not exceed a threshold defined for consecutive connectivity cycles of the MTC device;
• determining, by the telecommunications network node, during a second connectivity cycle of the MTC device, and using the stored rule derived from the CP information, that the MTC device is not behaving in accordance with the expected behavior, incrementing the count of incidents, determining that the count exceeds the threshold, and, in response to determining that the count exceeds the threshold defined for consecutive connectivity cycles of the MTC device, performing, by the telecommunications network node, a network security action that mitigates an effect of traffic from the MTC device on the network, wherein performing the network security action includes resetting the MTC device.