Security policy enforcement per user equipment (ue) behavior in mobile networks

A method, comprising:

• sending a request to subscribe to analytics information from an Application Function (AF) to a mobile core network;
• receiving an analytics information response from the mobile core network at the AF;
• and
• applying security policy enforcement based on User Equipment (UE) behavior using the AF based at least in part on one or more UE behaviors configured in a security policy based on the analytics information response.

A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

• sending a request to subscribe to analytics information from an Application Function (AF) to a mobile core network;
• receiving an analytics information response from the mobile core network at the AF;
• and
• applying security policy enforcement based on User Equipment (UE) behavior using the AF based at least in part on one or more UE behaviors configured in a security policy based on the analytics information response.

A system, comprising:

• a processor configured to:
• send a request to subscribe to analytics information from an Application Function (AF) to a mobile core network;
• receive an analytics information response from the mobile core network at the AF;
• enrich the analytics information response with User Equipment (UE) behavior associated information using the AF, wherein the UE behavior is associated with device related threat data from an internal source and/or an external source;
• and
• perform an action based on the analytics information response enriched with User Equipment (UE) behavior associated information;
• and
• a memory coupled to the processor and configured to provide the processor with instructions.