Isolated telco functions for enhanced security monitoring and analysis

Abstract

Solutions are disclosed that provide isolated telecommunication (telco) functions for enhanced security monitoring and analysis. Examples monitor a plurality of network functions (NFs) of a wireless network for indications of malicious activity, such as mobility management entities (MMEs), user plane functions (UPFs), authentication server functions (AUSFs), and others. When suspected malicious activity is detected from a user equipment (UE), an isolated telco stack (i.e., an isolated network slice) is stood up in real-time to isolate the traffic to/from the UE. This facilitates capturing and analyzing the traffic, so that a responsive action may be selected. The configuration of the isolated telco stack (i.e., the NFs included in the isolated network slice) may be customized based on the nature of the suspected malicious activity. For example, suspected data exfiltration will trigger a first configuration, whereas suspected denial service will trigger a different configuration.