Korea Internet & Security Agency

Jin Hyun Cho

Do Won Kim

Young Kwon Park

Hyung Jin Cho

Seong Min Park

Bo Min Choi

Tae Eun Kim

Hwan Kuk Kim

Sung Moon Kwon

Eun Hye Ko

Provided is a method for detecting abnormal traffic. The method comprises collecting non-access stratum (NAS) traffic between a user equipment (UE) and a mobility management node, identifying a ciphering algorithm supported by the UE from a network access request message transmitted from the UE to the mobility management node, and identifying the UE as a first type of terminal at risk based on a determination that the UE only supports a null ciphering algorithm.

Method and apparatus for detecting null-ciphering channels

Provided are methods of detecting a Diameter spoofing attack. According to an embodiment, the method comprises, obtaining a normal International Mobile Subscriber Identity (IMSI) from a packet of a Diameter S6a protocol transmitted from a Mobile Management Entity (MME) to a Home Subscriber Server (HSS) of a home network, adding a record comprising the normal IMSI to a session table, obtaining an Insert Subscriber Data Request (IDR) message of the Diameter S6a protocol and determining a category of the IDR message.

Method and apparatus for detecting diameter protocol IDR message spoofing attack in mobile communication network

Growing community of inventors

Jeollanam-do, South Korea

Jin Hyun Cho