# US 2023/0056017 A1 · Method and apparatus for detecting abnormal roaming request > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2023/0056017 A1 - Document ID: US20230056017A1 - Status: Published application - Kind: A1 - Application number: 17/849,406 - Filed: 2022-06-24 - Published: 2023-02-23 - Earliest claimed: 2021-08-18 - Assignees: Korea Internet & Security Agency - Applicants: Korea Internet & Security Agency - Inventors: Do Won KIM; Seong Min PARK; Hyung Jin CHO; Young Kwon PARK; Dae Un KIM; Sung Moon KWON - Web page: https://patentgrep.com/patent/US20230056017A1 ## CPC - H04W 12/122: Counter-measures against attacks; Protection against rogue devices - H04W 8/12: between location registers or mobility servers - H04W 12/088: using filters or firewalls - H04W 12/104: Location integrity, e.g. secure geotagging - H04W 12/61: Time-dependent - H04W 12/63: Location-dependent; Proximity-dependent - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract The exemplary embodiments of the present disclosure provide a method and an apparatus for detecting an abnormal roaming request which acquires information of user equipment which sends a roaming request message, calculates a risk of the roaming request message using a roaming request location and a roaming request time of the user equipment, and safely processes the request according to the risk. ## Claims ### Claim 1 An abnormal roaming request detecting method comprising: acquiring information of user equipment which sends a roaming request message; and calculating a risk of the roaming request message using a roaming request location and a roaming request time of the user equipment. ### Claim 2 (depends on 1) The abnormal roaming request detecting method according to claim 1, wherein the roaming request message is detected among traffics which pass through a gateway location registers (GLR). ### Claim 3 (depends on 1) The abnormal roaming request detecting method according to claim 1, wherein the roaming request message is a message which is requested from a home subscriber server (HSS) of an overseas network to a home subscriber server (HSS) of a domestic network. ### Claim 4 (depends on 1) The abnormal roaming request detecting method according to claim 1, wherein the roaming request message is a message which is requested from a subscriber server of an overseas network to a mobility management entity (MME) of a domestic network. ### Claim 5 (depends on 1) The abnormal roaming request detecting method according to claim 1, wherein in the acquiring of information of user equipment, an insert subscriber data request message is requested to a mobility management entity which finally accesses the domestic network to call a domestic last access time of the user equipment. ### Claim 6 (depends on 1) The abnormal roaming request detecting method according to claim 1, wherein the risk includes a first risk according to the roaming request location, a second risk according to the roaming request time, and a final risk having a combination thereof. ### Claim 7 (depends on 6) The abnormal roaming request detecting method according to claim 6, wherein in the calculating of a risk, if the roaming request location of the user equipment is in the reference area, the first risk is set to be high. ### Claim 8 (depends on 7) The abnormal roaming request detecting method according to claim 7, wherein the reference area is set to be in a predetermined radius range from a port or an airport. ### Claim 9 (depends on 6) The abnormal roaming request detecting method according to claim 6, wherein in the calculating of a risk, if a roaming request time in a roaming call country is an abnormal time, the second risk is set to be high. ### Claim 10 (depends on 9) The abnormal roaming request detecting method according to claim 9, wherein in the calculating of a risk, if a time obtained by subtracting the domestic last access time from the roaming request time is smaller than an average travel time to the roaming call country, the second risk may be set to be high. ### Claim 11 (depends on 6) The abnormal roaming request detecting method according to claim 6, wherein the final risk is classified into (i) a first state in which the first risk is low and the second risk is low, (ii) a second state in which the first state is low and the second risk is high or the first state is high and the second risk is low, and (iii) a third state in which the first risk is high and the second risk is high. ### Claim 12 (depends on 1) The abnormal roaming request detecting method according to claim 1, further comprising: processing the roaming request message based on the risk, wherein the roaming request message is blocked according to the risk and a manager is notified that the roaming request message is abnormal. ### Claim 13 (depends on 12) The abnormal roaming request detecting method according to claim 12, wherein in the processing of a roaming request message, a home subscriber server (HSS) of an overseas network which sends the roaming request message is classified as a fake home subscriber server to be managed. ### Claim 14 An abnormal roaming request detecting apparatus, comprising: a communication interface configured to acquire information of user equipment which sends a roaming request message; and a processor configured to calculate a risk of the roaming request message using a roaming request location and a roaming request time of the user equipment. ### Claim 15 (depends on 14) The abnormal roaming request detecting apparatus according to claim 14, wherein the risk includes a first risk according to the roaming request location, a second risk according to the roaming request time, and a final risk having a combination thereof. ### Claim 16 (depends on 15) The abnormal roaming request detecting apparatus according to claim 15, wherein if the roaming request location of the user equipment is in the reference area, the processor sets first risk to be high. ### Claim 17 (depends on 15) The abnormal roaming request detecting apparatus according to claim 15, wherein if a roaming request time in a roaming call country is an abnormal time, the processor sets the second risk to be high. ### Claim 18 (depends on 15) The abnormal roaming request detecting apparatus according to claim 15, wherein the final risk is classified into (i) a first state in which the first risk is low and the second risk is low, (ii) a second state in which the first state is low and the second risk is high or the first state is high and the second risk is low, and (iii) a third state in which the first risk is high and the second risk is high. ### Claim 19 (depends on 14) The abnormal roaming request detecting apparatus according to claim 14, wherein the processor blocks the roaming request message according to the risk and the communication interface notifies a manager that the roaming request message is abnormal. ### Claim 20 (depends on 1) A computer readable storage medium which stores a computer program which is executable by the computer, in which a computer program which is capable of executing the method of claim 1 is recorded. ### Claim 21 (depends on 1) A computer program recorded in a computer readable storage medium including computer program instructions executable by the processor, wherein when the computer program instructions are executed by the processor, the method according to claim 1 is performed.