Method and apparatus for detecting null-ciphering channels

An apparatus for detecting abnormal traffic comprising:

• a network interface for collecting non-access stratum (NAS) traffic between a user equipment (UE) and a mobility management node;
• a memory for loading a computer program for analyzing collected traffic;
• and
• a processor for executing the loaded computer program,
• wherein the computer program comprises
• an instruction for identifying a ciphering algorithm supported by the UE from a network access request message transmitted from the UE to the mobility management node;
• and
• an instruction for identifying the UE as a first type of risk terminal attempting to disable ciphering based on a determination that the UE supports only a null ciphering algorithm among ciphering algorithms.

A mobile communication system comprising:

• a core network including a mobility management node;
• and
• an abnormal traffic detection system
• wherein the abnormal traffic detection system is configured to
• collect traffic between the mobility management node and the UE,
• identify a ciphering algorithm supported by the UE from a network access request message transmitted from the UE to the mobility management node,
• identify the UE as a first type of risk terminal attempting to disable ciphering based on a determination that the UE supports only a null ciphering algorithm among ciphering algorithms,
• determine whether an access accept message has been transmitted to the UE from the mobility management node, and
• identify a channel formed between the UE and the mobility management node as a channel at risk based on a determination that the access accept message has been transmitted.