# US 2023/0054030 A1 · Scrubber for distributed denial of service attacks targetting mobile networks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2023/0054030 A1 - Document ID: US20230054030A1 - Status: Published application - Kind: A1 - Application number: 17/981,545 - Filed: 2022-11-07 - Published: 2023-02-23 - Earliest claimed: 2020-05-20 - Assignees: AT&T Intellectual Property I, L.P. - Applicants: AT&T Intellectual Property I, L.P. - Inventors: Yaron Koral; Tzvi Chumash - Web page: https://patentgrep.com/patent/US20230054030A1 ## CPC - H04L 63/00: {Network architectures or network communication protocols for network security (cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1458: {Denial of Service} - H04W 12/122: Counter-measures against attacks; Protection against rogue devices - H04L 2463/142: Denial of service attacks against network infrastructure - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A device includes a processor and a memory. The processor effectuates operations including receiving signaling messages traversing a first interface or a second interface from the network traffic, translating the signaling messages into one or more events, detecting one or more anomalies by analyzing the one or more events, determining whether the one or more anomalies is indicative of an attack on a telecommunications network and performing a remediation action to the signaling messages resolving the attack when the one or more anomalies is indicative of an attack on the telecommunications network. ## Claims ### Claim 1 A device, comprising: a processor; and a memory coupled with the processor, the memory storing executable instructions that, when executed by the processor, cause the processor to effectuate operations comprising: receiving, from network traffic, first signaling messages traversing a first interface of a core network and second signaling messages traversing a second interface of the core network, wherein the first signaling messages are intercepted by the processor prior to reaching a first function of the core network, and wherein the second signaling messages are intercepted by the processor prior to reaching a second function of the core network; identifying a network attack based on an analysis of the first signaling messages and the second signaling messages; based on the identifying the network attack, performing a remediation action to the first signaling messages and the second signaling messages to resolve the network attack; and sending the first signaling messages to the first function and the second signaling messages to the second function after the performing the remediation action. ### Claim 2 (depends on 1) The device of claim 1, wherein the processor is positioned in-line with the first interface and the second interface so as to intercept the first signaling messages and the second signaling messages, wherein the first signaling messages include user equipment (UE) registration and mobility information, and wherein the second signaling messages include user information. ### Claim 3 (depends on 1) The device of claim 1, wherein the identifying the network attack comprises identifying one or more anomalies, and wherein the processor further effectuates operations comprising classifying the one or more anomalies according to an attack type and implementing an action policy to perform the remediation action based on the attack type. ### Claim 4 (depends on 3) The device of claim 3, wherein the one or more anomalies comprise attaches per day, attaches per device, or attaches per day per equipment type exceeding a predetermined threshold. ### Claim 5 (depends on 1) The device of claim 1, wherein the first and second signaling messages are received at an edge router from one or more Internet-of-things (IoT) devices. ### Claim 6 (depends on 1) The device of claim 1, wherein the remediation action comprises denying all registration requests of a set of user equipment (UE) of a plurality of UE to connect to a telecommunications network, denying a set of UE of the plurality of UE from connecting to the telecommunications network while allowing another set of UE of the plurality of UE to connect to the telecommunications network, reducing a rate of control messages from the plurality of UE, or blocking attach requests from the plurality of UE associated with a determined attack type. ### Claim 7 (depends on 1) The device of claim 1, wherein the network traffic comprises a request to attach to a telecommunications network, a request to re-register to the telecommunications network, a request for authentication information, or a request for resource allocation information. ### Claim 8 (depends on 1) The device of claim 1, wherein the first interface is a N1 interface or a S1 interface and the second interface is a N11 interface or a S11 interface. ### Claim 9 A computer-implemented method comprising: obtaining, by a processor, first signaling messages traversing a first interface associated with a first function of a core network and second signaling messages traversing a second interface associated with a second function of the core network, wherein the first signaling messages are intercepted by the processor prior to reaching the first function, and wherein the second signaling messages are intercepted by the processor prior to reaching the second function; determining, by the processor, and based on analyzing the first signaling messages and the second signaling messages, that a network attack is undergoing; responsive to the determining, performing, by the processor, a remediation action to the first signaling messages and the second signaling messages to resolve the network attack; and causing, by the processor, the first signaling messages to be transmitted to the first function and the second signaling messages to be transmitted to the second function. ### Claim 10 (depends on 9) The computer-implemented method of claim 9, wherein the first and second signaling messages are included in network traffic, wherein the processor is positioned in-line with the first interface and the second interface so as to intercept the first signaling messages and the second signaling messages, wherein the first signaling messages include user equipment (UE) registration and mobility information, and wherein the second signaling messages include user information. ### Claim 11 (depends on 10) The computer-implemented method of claim 10, wherein the network traffic comprises a request to attach to a telecommunications network, a request to re-register to the telecommunications network, a request for authentication information, or a request for resource allocation information. ### Claim 12 (depends on 9) The computer-implemented method of claim 9, wherein the determining comprises identifying one or more anomalies, and wherein the computer-implemented method further comprises classifying the one or more anomalies according to an attack type and implementing an action policy to perform the remediation action based on the attack type. ### Claim 13 (depends on 12) The computer-implemented method of claim 12, wherein the one or more anomalies comprise attaches per day, attaches per device, or attaches per day per equipment type exceeding a predetermined threshold. ### Claim 14 (depends on 9) The computer-implemented method of claim 9, wherein the first and second signaling messages are received at an edge router from one or more Internet-of-things (IoT) devices. ### Claim 15 (depends on 9) The computer-implemented method of claim 9, wherein the remediation action comprises denying all registration requests of a set of user equipment (UE) of a plurality of UE to connect to a telecommunications network, denying a set of UE of the plurality of UE from connecting to the telecommunications network while allowing another set of UE of the plurality of UE to connect to the telecommunications network, reducing a rate of control messages from the plurality of UE, or blocking attach requests from the plurality of UE associated with a determined attack type. ### Claim 16 (depends on 9) The computer-implemented method of claim 9, wherein the first interface is a N1 interface or a S1 interface and the second interface is a N11 interface or a S11 interface. ### Claim 17 A non-transitory computer-readable storage medium storing executable instructions that when executed by a processor causes said processor to effectuate operations comprising: receiving, from network traffic originating from one or more user equipment (UEs), first signaling messages traversing a first interface associated with a first network function and second signaling messages traversing a second interface associated with a second network function, wherein the first signaling messages are intercepted by the processor prior to reaching the first network function, and wherein the second signaling messages are intercepted by the processor prior to reaching the second network function; identifying a denial-of-service (DoS) attack on a telecommunications network based on an analysis of the first signaling messages and the second signaling messages; performing a remediation action to the first signaling messages and the second signaling messages to resolve the DoS attack; and transmitting the first signaling messages to the first network function and the second signaling messages to the second network function after the performing the remediation action. ### Claim 18 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein the processor is positioned in-line with the first interface and the second interface so as to intercept the first signaling messages and the second signaling messages, wherein the first signaling messages include UE registration and mobility information, and wherein the second signaling messages include user information. ### Claim 19 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein the first interface is a N1 interface or a S1 interface and the second interface is a N11 interface or a S11 interface. ### Claim 20 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein the first and second signaling messages are received at an edge router from one or more Internet-of-things (IoT) devices.