Automated suspect device filtering on equipment identity registers

A method for suspect device filtering in a wireless communication network, the method comprising:

• determining that a triggering event has occurred in a geographic area, the triggering event comprising a threshold high utilization of one or more radio access network nodes in the geographic area;
• subsequent to said determination, receiving, at a radio access network, a plurality of requests for a network service from a user device, wherein the user device is associated with a permanent device identifier;
• communicating the plurality of requests for the network service to a network function, wherein the network function is associated with the provision of the requested network service;
• determining, by the network function, and based at least in part on the receipt of the plurality of requests for the network service from the user device during a first predetermined time period and that the user device is located in the geographic area, that the user device is suspect;
• adding the user device to a suspect device list, wherein the suspect device list is stored on a data repository;
• and
• ignoring subsequent requests from the user device for the network service after the access denial is communicated.

A method for suspect device filtering in a wireless communication network, the method comprising:

• receiving, at a networked computer processing component, a plurality of requests for a network service from a device attempting to access one or more internet resources, wherein the device is associated with a permanent device identifier, and wherein the networked computer processing component is associated with a provider of internet service;
• determining, by the networked computer processing component, and based at least in part on the receipt of the plurality of requests from the device during a first predetermined time period, that the device is suspect;
• adding the device to a locally stored suspect device list maintained on the networked computer processing component;
• receiving a subsequent request from the device at the networked computer processing component;
• determining, based on a query of the locally stored suspect device list, that the device is blacklisted;
• communicating an access denial from the networked computer processing component to the device;
• and
• ignoring subsequent requests from the user device for the network service after the access denial is communicated,
• wherein determining that the device is suspect comprises the networked computer processing component determining that a number of the plurality of requests that have been received by the networked computer processing component within a predetermined time period exceed a predetermined threshold,
• wherein the locally stored suspect device list is a first-level suspect device list that limits access to one or more network services for the device, and wherein the method further comprises, in response to receiving one or more additional requests from the device after the device is added to the first-level suspect device list, adding the device to a higher-level suspect device list that prevents the device from accessing the one or more network services list, adding the device to a higher-level suspect device list that prevents the device from accessing the one or more network services.