Method and apparatus for monitoring and filtering abnormal behavior of mobile stations in a wireless network

• US 20040162070A1
• Filed: 02/14/2003
• Published: 08/19/2004
• Est. Priority Date: 02/14/2003
• Status: Abandoned Application

• Current Assignee: Lucent Technologies, Inc. (Nokia Corporation)
• Original Assignee: Lucent Technologies, Inc. (Nokia Corporation)
• Inventors: Bradley, Richard H., Baral, Elliott, Rossetti, David Albert, Smith, Harold Robert Jr.
• Application Number:
  US10/367,482
• Publication Number:
  US 20040162070A1
• Time in Patent Office: Days
• US Class Current: 455/435.1
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/71 Hardware identity
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements

Abstract

This invention relates to a method and apparatus for monitoring and filtering abnormal behavior of mobile stations in a wireless network. More particularly, in one form, the invention is directed to a system to monitor and filter the abnormally high frequency of registrations of a malfunctioning, or rogue, mobile station on a network.

Claims

1. A method for use in a network comprising steps of:

sequentially recording in a first location electronic serial numbers of mobile stations initiating an event on the network, the first location having n storage portions to store the electronic serial numbers corresponding to the n most recent attempts of the mobile stations to originate the event on the network;

identifying an electronic serial number of a single mobile station that is recorded more than once in the first location at a given time;

recording the electronic serial number of the single mobile station in a second location; and

,

identifying the single mobile station if the electronic serial number is recorded in the second location a predetermined number of times within a predetermined period of time.

2. The method as set forth in claim 1 wherein the recording includes generating a timestamp identifying an initial recording of the electronic serial number of the single mobile station in the second location.

3. The method as set forth in claim 1 wherein the recording includes incrementing a counter in the second table identifying a number of times that the electronic serial number of the single mobile station is recorded in the second location within the predetermined period of time.

4. The method as set forth in claim 1 wherein the event is autonomous registration.

5. The method as set forth in claim 1 wherein n is approximately two thousand (2,000).

6. The method as set forth in claim 1 wherein the identifying of the electronic serial number of the single mobile station that is recorded more than once in the first location comprises comparing the electronic serial number corresponding to the most recent attempt to autonomously register with the electronic serial numbers recorded in the first location.

7. The method as set forth in claim 1 further comprising identifying an action to be taken based on identifying the single mobile station.

8. An apparatus for use in a network, the apparatus comprising:

first means for recording electronic serial numbers of mobile stations attempting to originate an event on the network, the first recording means having n storage locations to store the electronic serial numbers corresponding to the n most recent attempts of the mobile stations to originate the event on the network;

first means for identifying an electronic serial number of a single mobile station that is recorded more than once in the sequential storing means at a given time;

second means for recording the electronic serial number of the single mobile station; and

,

second means for identifying the single mobile station if the electronic serial number is recorded in the second recording means a predetermined number of times within a predetermined period of time.

9. The apparatus as set forth in claim 8 wherein the second recording means includes means for generating a timestamp identifying an initial recording of the electronic serial number of the single mobile station in the second recording means.

10. The apparatus as set forth in claim 8 wherein the second recording means includes a counter identifying a number of times that the electronic serial number of the single mobile station is recorded within the predetermined period of time.

11. The apparatus as set forth in claim 8 wherein the event is autonomous registration.

12. The apparatus as set forth in claim 8 wherein n is approximately two thousand (2,000).

13. The apparatus as set forth in claim 8 wherein the first means for identifying the electronic serial number of the single mobile station that is recorded more than once comprises means for comparing the electronic serial number corresponding to the most recent attempt to autonomously register with the electronic serial numbers recorded in the first recording means.

14. The apparatus as set forth in claim 8 further comprising an action module operative to store actions to be taken based on the second means for identifying.

15. A method for use in a network comprising steps of:

sequentially recording in a first table electronic serial numbers of mobile stations attempting to autonomously register on the network, the first table having n storage locations to store the electronic serial numbers corresponding to the n most recent attempts of the mobile stations to autonomously register on the network;

identifying an electronic serial number of a single mobile station that is recorded more than once in the first table at a given time;

recording the electronic serial number of the single mobile station in a second table; and

,

identifying the single mobile station if the electronic serial number is recorded in the second table a predetermined number of times within a predetermined period of time.

16. The method as set forth in claim 15 wherein the recording includes generating a timestamp identifying an initial recording of the electronic serial number of the single mobile station in the second table.

17. The method as set forth in claim 15 wherein the recording includes incrementing a counter in the second table identifying a number of times that the electronic serial number of the single mobile station is recorded in the second table within the predetermined period of time.

18. The method as set forth in claim 15 wherein n is approximately two thousand (2,000).

19. The method as set forth in claim 15 wherein the identifying of the electronic serial number of the single mobile station that is recorded more than once in the first table comprises comparing the electronic serial number corresponding to the most recent attempt to autonomously register with the electronic serial numbers recorded in the first table.

20. The method as set forth in claim 15 further comprising identifying an action to be taken based on identification of the single mobile station.

21. An apparatus for use in a network, the apparatus comprising:

first means for recording electronic serial numbers of mobile stations attempting to autonomously register on the network, the first recording means having n storage locations to store the electronic serial numbers corresponding to the n most recent attempts of the mobile stations to autonomously register on the network;

first means for identifying an electronic serial number of a single mobile station that is recorded more than once in the sequential storing means at a given time;

second means for recording the electronic serial number of the single mobile station; and

,

second means for identifying the single mobile station if the electronic serial number is recorded in the second recording means a predetermined number of times within a predetermined period of time.

22. The apparatus as set forth in claim 21 wherein the second recording means includes means for generating a timestamp identifying an initial recording of the electronic serial number of the single mobile station in the second recording means.

23. The apparatus as set forth in claim 21 wherein the second recording means includes a counter identifying a number of times that the electronic serial number of the single mobile station is recorded in the second table within the predetermined period of time.

24. The apparatus as set forth in claim 21 wherein n is approximately two thousand (2,000).

25. The apparatus as set forth in claim 21 wherein the first means for identifying the electronic serial number of the single mobile station that is recorded more than once in the first table comprises means for comparing the electronic serial number corresponding to the most recent attempt to autonomously register with the electronic serial numbers recorded in the first recording means.

26. The apparatus as set forth in claim 21 further comprising an action module to store actions to be taken based on the second identifying means output.