Anomalous entitlement request detection

At least one non-transitory, computer-readable storage medium storing instructions, which, when executed by at least one data processor of a system, cause the system to:

• receive, at an entitlement server of a telecommunication network provided by a mobile network operator (MNO), a request for a change to an entitlement of a subscriber to the MNO on a wireless device;
• receive, from one or more servers of the telecommunication network other than the entitlement server, network activity data relating to activity of the subscriber or the wireless device collected by the MNO during a time period prior to or concurrent with the request for the change to the entitlement of the subscriber to the MNO on the wireless device;
• determine, by a machine learning model and based on the network activity data, whether the request for the change to the entitlement of the subscriber to the MNO on the wireless device is anomalous,
• wherein the machine learning model is trained on previous sets of additional network activity data collected by the MNO and related to previous requests for entitlement changes on the telecommunication network, each of the previous sets of additional network activity data tagged as anomalous or typical of an expected entitlement change request;
• and
• in response to determining that the change to the entitlement of the subscriber to the MNO on the wireless device is anomalous, perform a security operation associated with the subscriber.

A method comprising:

• receiving, at an entitlement server of a telecommunication network provided by a mobile network operator (MNO), a request for a change to an entitlement of a subscriber to the MNO on a wireless device;
• receiving, from one or more servers of the telecommunication network other than the entitlement server, network activity data relating to activity of the subscriber or the wireless device collected by the MNO during a time period prior to or concurrent with the request for the change to the entitlement of the subscriber to the MNO on the wireless device;
• determining, by a machine learning model and based on the network activity data, that the request for the change to the entitlement of the subscriber to the MNO on the wireless device is anomalous,
• wherein the machine learning model is trained on previous sets of additional network activity data collected by the MNO and related to previous requests for entitlement changes on the telecommunication network, each of the previous sets of additional network activity data tagged as anomalous or typical of an expected entitlement change request;
• and
• in response to determining that the change to the entitlement of the subscriber to the MNO on the wireless device is anomalous, performing a security operation associated with the subscriber.