System and method for threat detection and sim cloning in telecommunication monitoring infrastructure

A system for managing subscriber data within a telecom communication network comprising:

• one or more processors configured to:
• populate, by a control node, a control database with subscriber control information based on a plurality of targeted data packets received from an N11/S11 interface;
• append timestamp information derived from the plurality of targeted data packets;
• fetch subscriber control information from the control database;
• track subscriber transitions between coverage areas of different towers to create subscriber handover data including user location information;
• correlate incoming user plane packets with corresponding subscriber information;
• and generate an alert of a detected threat when a packet from an IMSI/IMEI is received at approximately the same time from two or more different locations.

A non-transitory computer-readable medium storing a set of instructions for managing subscriber data within a telecom communication network, the set of instructions comprising:

• one or more instructions that, when executed by one or more processors of a device, cause the device to:
• populate, by a control node, a control database with subscriber control information based on a plurality of targeted data packets received from an N11/S11 interface;
• append timestamp information derived from the plurality of targeted data packets;
• fetch subscriber control information from the control database;
• track subscriber transitions between coverage areas of different towers to create subscriber handover data including user location information;
• correlate incoming user plane packets with corresponding subscriber information;
• and
• generate an alert of a detected threat when a packet from an IMSI/IMEI is received at approximately the same time from two or more different locations.