Isolated telco functions for enhanced security monitoring and analysis

A system comprising:

• a processor;
• and
• a computer-readable medium storing programming instructions for execution by the processor, the programming instructions, upon execution by the processor, causing the system to perform the following operations:
• monitoring, by a security orchestrator, network functions (NFs) of a wireless network for indications of malicious activity in a first portion of the wireless network;
• detecting, by the security orchestrator while monitoring the NFs, a specific type of malicious activity from a list of malicious activity types that includes a data exfiltration malicious activity type, an unauthorized use malicious activity type, a denial of service malicious activity type, an API exploitation malicious activity type, a reconnaissance malicious activity type, a replay attack malicious activity type, and a packet tampering malicious activity type;
• selecting a specific subset of the NFs to form an isolated network slice based on the specific type of malicious activity detected by the security orchestrator, wherein different subsets of the NFs are selected to form the isolated network slice for different detected malicious activity types in the list of malicious activity types;
• identifying a user equipment (UE) associated with the specific type of malicious activity;
• moving the UE to the isolated network slice;
• analyzing traffic of the UE captured from the isolated network slice;
• based on at least analyzing the traffic of the UE captured from the isolated network slice, selecting a responsive action to apply to the UE;
• and
• applying the responsive action to the UE.

One or more computer storage devices having programming instructions stored thereon, which, upon execution by a processor of a system, cause the system to perform the following operations:

• monitoring, by a security orchestrator, network functions (NFs) of a wireless network for indications of malicious activity in a first portion of the wireless network;
• detecting, by the security orchestrator while monitoring the NFs, a specific type of malicious activity from a list of malicious activity types that includes a data exfiltration malicious activity type, an unauthorized use malicious activity type, a denial of service malicious activity type, an API exploitation malicious activity type, a reconnaissance malicious activity type, a replay attack malicious activity type, and a packet tampering malicious activity type;
• selecting a specific subset of the NFs to form an isolated network slice based on the specific type of malicious activity detected by the security orchestrator, wherein different subsets of the NFs are selected to form the isolated network slice for different detected malicious activity types in the list of malicious activity types;
• identifying a user equipment (UE) associated with the specific type of malicious activity;
• moving the UE to the isolated network slice;
• analyzing traffic of the UE captured from the isolated network slice;
• based on at least analyzing the traffic of the UE captured from the isolated network slice, selecting a responsive action to apply to the UE;
• and
• applying the responsive action to the UE.