At&t Intellectual Property I, L.p.

Princeton University

At&t Technical Services Company, Inc.

Interwise Ltd.

Yaron Koral

Simon Tse

Steven A Monetti

Tzuu-Yi Wang

Kaustubh Joshi

Rensheng Wang Zhang

Arun Jotshi

Kathleen S Meier-Hellstern

Jennifer Lynn Rexford

Shraboni Jana

Tuan Duong

Richard Koch

Lauro Lins

Xiaoqi Chen

Shir Landau Feibish

Eric Noel

Cagatay Buyukkoc

Bogdan Ungureanu

Richard Zaffino

Patrick Michael Velardo, Jr

Jitendra Patel

Arnold Schrider

Nicholas Arconati

Swapna Buccapatnam Tirumala

Deon Ogle

Kenneth Duell

Han Q Nguyen

Anestis Karasaridis

Kartik Pandit

Richard Hellstern

Tzvi Chumash

Ashwin Sridharan

Lukasz Grabarski

Adi Enzel

Aspects of the subject disclosure may include, for example, a device, having a processing system including a processor; and a memory that stores executable instructions that, when executed by the processing system, facilitate performance of operations, including gathering and aggregating historical data provided to an APN gateway of a connected car manufacturer and a packet core of a communications network; using the historical data gathered and aggregated to train a ML model to recognize anomalies from the historical data, thereby creating a trained ML model; monitoring current data provided to the APN gateway and the packet core; and generating an alert when the trained ML model recognizes an anomaly. Other embodiments are disclosed.

System and method for identifying communications network anomalies of connected cars

Cells of a network can be clustered based on signaling behavior, and abnormal signaling conditions against cells can be detected and mitigated. A security management component (SMC) can determine a neural network (NN) of NNs that can be representative of the cell network based on analysis of first signal measurement data associated with the cells. The NN can cluster respective cells into respective clusters based on analysis of second signal measurement data associated with the cells. The NN can determine whether an abnormal signaling condition associated with a cell is occurring based on analysis of third signal measurement data associated with the cells, information relating to the cluster to which the cell is assigned, and a defined network security criterion. SMC can perform feature reforming on the first, second, and/or third signal measurement data to reduce dimensionality of such data to facilitate processing by the NN.

Clustering cell sites according to signaling behavior

The concepts and technologies disclosed herein are directed to home gateway monitoring for vulnerable home Internet of Things ('IoT') devices. According to one aspect disclosed herein, a home gateway can scan a home network address space of a home network for an IoT device. The home gateway can perform a vulnerability test on the IoT device to determine whether the IoT device is vulnerable to a known vulnerability. In response to determining that the IoT device is vulnerable to the known vulnerability, the home gateway can change a device status of the IoT device to a vulnerable status and can change a permissions level of the IoT device to a quarantine permissions level.

Home gateway monitoring for vulnerable home internet of things devices

A processing system may obtain a first network event data set associated with a telephone number, where the first network event data set includes identifier matching data associated with the telephone number. The processing system may next apply an input data set comprising at least the first network event data set to a machine learning model implemented by the processing system to obtain an authenticity score associated with the telephone number, where the machine learning model is configured to generate the authenticity score associated with the telephone number in accordance with the input data set. The processing system may next obtain a request from a first authentication service for the authenticity score associated with the telephone number and may transmit the authenticity score associated with the telephone number to the first authentication service in response to the request.

Telecommuncation network verification for two-factor authentication

Network access management can include receiving a request to enable network access for a guest user device at a geographic location associated with a gateway device. Connection parameters can be defined, the connection parameters including an effective-from date and time and an effective-to date and time. Credentials associated with the guest user device can be stored with data defining limits associated with the network access for the guest user device, the limits including a date and time limit. The gateway device can detect a guest login using the credentials; enable network access for the guest user device; apply, to the network access, the limits; and determine if the date and time limit is satisfied. When the date and time limit is exceeded, the network access can be terminated and the credentials can be revoked.

Network access management

The disclosed technology is directed towards detecting improbable speeds of a mobile device, which can indicate fraudulent activity with respect to the mobile device. Radio access network events and call detail records are processed to determine when a mobile device 'travel jumps' between locations at improbable speeds. Events corresponding to handovers between adjacent cells are filtered out. For events corresponding to changed cell towers that are non-adjacent, further processing is performed to determine the speed of the mobile device travel between the cells. A first speed threshold is selected based on possible air travel (a cell near an airport) or a second non-air travel speed threshold is selected. If the speed of the mobile device exceeds the selected speed threshold, a travel jump is determined. Exceptions can be made for gaps in connectivity due to topography (known inconsistent reception areas) and for a mobile device shutting down and restarting.

Detection of unlikely travel of mobile devices indicative of fraudulent mobile device usage

Excessive signaling by devices against a radio access network (RAN) can be detected and mitigated. A security management component (SMC) can determine whether a total number of control signals received by a base station from devices satisfies a threshold total number of control signals indicative of excessive signaling. If so, SMC can identify a device associated with the base station based on analyzing communication conditions associated with the device. SMC can determine whether to classify the device as an excessive signaling device based on whether the number of control signals received from the device by the base station satisfies a threshold number of control signals indicative of excessive signaling. If so, SMC can determine the device is an excessive signaling device. In response, SMC can perform or facilitate performing a mitigation action to mitigate excessive signaling or can generate statistics relating to the excessive signaling.

Correlating radio access network messages of aggressive mobile devices

A distributed denial of service ('DDoS') attack profiler can determine a plurality of DDoS attack properties associated with a DDoS attack that utilizes an Internet of Things (“IoT”) device operating in communication with a home gateway. The DDoS attack profiler can create a DDoS attack profile and can provide a DDoS attack report based upon the DDoS attack profile to a correlator. An IoT device profiler can determine a plurality of IoT device properties and can create, based upon the plurality of IoT device properties, an IoT device profile. The IoT device profiler can create an anomaly report that identifies an anomaly associated with the IoT device. The correlator can correlate the DDoS attack report with the anomaly report to determine if a match exists. In response to determining that the match exists, the home gateway system can store the bot match record in a bot match repository.

Correlating compromised home internet of things devices with distributed denial of service attacks

Aspects of detecting and mitigating denial of service ('DoS') attacks over home gateway network address translation (“NAT”) are disclosed herein. According to one aspect disclosed herein, a home gateway system can detect that a NAT table is overpopulated. In response to detecting that the NAT table is overpopulated, the home gateway system can determine a mitigation action to be performed. The home gateway system can then perform the mitigation action in an attempt to mitigate an effect of the NAT table overpopulation.

Detecting and mitigating denial of service attacks over home gateway network address translation

Systems, methods, and apparatuses provide a scalable framework for analyzing queuing and transient congestion in network switches. The system reports which flows contributed to the queue buildup and enables direct per-packet action in the data plane to prevent transient congestion. The system may be configured to analyze queuing in legacy network switches.

Microburst detection and management

The disclosed technology is directed towards detecting suspected malicious activity involving mobile devices and subscriber identity module (SIM) cards, including discerning benign SIM swap events from likely malicious SIM swap events. In one example, call detail records, radio access network events and billing events are collected and analyzed to detect subscriber identity module swap events between mobile devices. Based on the collected data and related data sources SIM swap events are classified as benign or suspected malicious classifications. Malicious classifications can result in information representative of the suspected as malicious classification being output, e.g., as a type of fraudulent activity. A confidence level can be associated with classification output data, including for types of fraudulent activities and types of benign activities.

Carrier grade identification of subscriber identity module card-related fraudulent events

A method and apparatus for authenticating a device on a wireless network using a secure attestation package is provided. The method includes receiving, by a processor, information related to a device of an Internet of Thing (IoT) service provider, generating, by the processor, a secure attestation package based on the information, transmitting, by the processor, the secure attestation package to the IoT service provider, receiving, by the processor, a request to access a wireless network of the processor from the device of the IoT service provider, and authorizing, by the processor, the device to access the wireless network based on the secure attestation package.

Secure attestation packages for devices on a wireless network

Malicious attacks by certain devices against a radio access network (RAN) can be detected and mitigated, while allowing communication of priority messages. A security management component (SMC) can determine whether a malicious attack against the RAN is occurring based on a defined baseline that indicates whether a malicious attack is occurring. The defined baseline is determined based on respective characteristics associated with respective devices that are determined based on analysis of information relating to the devices. In response to determining there is a malicious attack, SMC determines whether to block connections of devices to the RAN based on respective priority levels associated with respective messages being communicated by the devices. SMC blocks connections of devices communicating messages associated with priority levels that do not satisfy a defined threshold priority level, while managing communication connections to allow messages satisfying the defined threshold priority level to be communicated via the RAN.

Growing community of inventors

Cherry Hill, NJ, United States of America

Yaron Koral