Scrubber for distributed denial of service attacks targetting mobile networks

A computer-implemented method comprising:

• obtaining, by a processor, first signaling messages traversing a first interface associated with a first function of a core network and second signaling messages traversing a second interface associated with a second function of the core network, wherein the first signaling messages are intercepted by the processor prior to reaching the first function, and wherein the second signaling messages are intercepted by the processor prior to reaching the second function;
• determining, by the processor, and based on analyzing the first signaling messages and the second signaling messages, that a network attack is undergoing;
• responsive to the determining, performing, by the processor, a remediation action to the first signaling messages and the second signaling messages to resolve the network attack;
• and
• causing, by the processor, the first signaling messages to be transmitted to the first function and the second signaling messages to be transmitted to the second function.

A non-transitory computer-readable storage medium storing executable instructions that when executed by a processor causes said processor to effectuate operations comprising:

• receiving, from network traffic originating from one or more user equipment (UEs), first signaling messages traversing a first interface associated with a first network function and second signaling messages traversing a second interface associated with a second network function, wherein the first signaling messages are intercepted by the processor prior to reaching the first network function, and wherein the second signaling messages are intercepted by the processor prior to reaching the second network function;
• identifying a denial-of-service (DoS) attack on a telecommunications network based on an analysis of the first signaling messages and the second signaling messages;
• performing a remediation action to the first signaling messages and the second signaling messages to resolve the DoS attack;
• and
• transmitting the first signaling messages to the first network function and the second signaling messages to the second network function after the performing the remediation action.