Monitoring of signalling traffic

• US 9,769,670 B2
• Filed: 11/05/2015
• Issued: 09/19/2017
• Est. Priority Date: 11/05/2014
• Status: Active Grant

• Current Assignee: Vodafone IP Licensing Limited (Vodafone Group PLC)
• Original Assignee: Vodafone IP Licensing Limited (Vodafone Group PLC)
• Inventors: Sporton, Simon, Sutherns, Timothy, Sauder, Oliver
• Primary Examiner(s): Milord, Marceau
• Application Number:
  US14/933,829
• Publication Number:
  US 20160127908A1
• Time in Patent Office: 684 Days
• Field of Search: 455410, 455411, 4554141
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 15/58 based on statistics of usage or network monitoring
• CPC Class Codes: H04Q 2213/13527 protocols - X.25, TCAP etc.
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 4/12 Messaging; Mailboxes; Announcements

Abstract

Signalling messages may be monitored in a telecommunications network by receiving an indication of a signalling message for a network entity of the telecommunications network, the signalling message comprising a signalling dialog identifier. The signalling dialog identifier of the received signalling message is compared with a list of known signalling dialog identifiers relating to the network entity and the signalling message is categorized based on a result of the step of comparing, for example as suspicious. If a number of signalling messages for a network entity of the telecommunications network categorized as suspicious and having a common additional characteristic is at least a threshold value, an alert may be generated.

Claims

1. A method of monitoring signalling messages in a telecommunications network, comprising:

receiving an indication of a signalling message for a network entity of the telecommunications network, the signalling message comprising a signalling dialogue identifier;

comparing the signalling dialogue identifier of the received signalling message with a list of known signalling dialogue identifiers relating to the network entity;

categorizing the signalling message based on a result of the step of comparing by identifying the signalling message as normal or suspicious; and

identifying an anomalous situation, by determining that a number of signalling messages for the network entity that are categorized as suspicious and that have a common additional characteristic, is at least a threshold value,

wherein the signalling message further comprises a message type and the step of categorizing is based on the message type, wherein the message type comprises one of;

a dialogue initiation message;

a dialogue continuation message; and

a dialogue termination message,

wherein;

if the message type is a dialogue continuation message or a dialogue termination message and the step of comparing results in no match between the signalling dialogue identifier of the received signalling message and the list of known signalling dialogue identifiers relating to the network entity, the signalling message is categorized as suspicious; and

if the message type is a dialogue continuation message or a dialogue termination message and the step of comparing results in a match between the signalling dialogue identifier of the received signalling message and the list of known signalling dialogue identifiers relating to the network entity, the signalling message is categorized as normal.

2. The method of claim 1 further comprising, in response to the step of categorizing identifying the signalling message as suspicious, one or both of:

generating an alert; and

logging the received signalling message.

3. The method of claim 1, wherein the step of categorizing identifies the signalling message as suspicious is based on the message type being a dialogue continuation message or a dialogue termination message.

4. The method of claim 1, wherein the signalling message is in accordance with a Signalling System 7 (SS7) protocol stack.

5. The method of claim 1, wherein the signalling message uses a Transaction Capabilities Application Part (TCAP) protocol, the signalling dialogue identifier comprising a transaction ID.

6. The method of claim 1, wherein the method is carried out at the network entity or at a network protection component associated with the telecommunications network.

7. A computer program product, configured, when executed by a processor, to carry out the method of claim 1.

8. A network protection device configured to operate in accordance with the method of claim 1.

9. A network entity of a telecommunications network, configured to receive signalling messages from outside the telecommunications network and comprising the network protection device of claim 8.

10. A method of monitoring signalling messages in a telecommunications network, comprising:

receiving an indication of a signalling message for a network entity of the telecommunications network, the signalling message comprising a signalling dialogue identifier;

comparing the signalling dialogue identifier of the received signalling message with a list of known signalling dialogue identifiers relating to the network entity; and

categorizing the signalling message based on a result of the step of comparing by identifying the signalling message as normal or suspicious;

wherein the signalling message further comprises a message type and the step of categorizing is based on the message type,

wherein;

if the message type is a dialogue continuation message or a dialogue termination message and the step of comparing results in no match between the signalling dialogue identifier of the received signalling message and the list of known signalling dialogue identifiers relating to the network entity, the signalling message is categorized as suspicious; and

if the message type is a dialogue continuation message or a dialogue termination message and the step of comparing results in a match between the signalling dialogue identifier of the received signalling message and the list of known signalling dialogue identifiers relating to the network entity, the signalling message is categorized as normal.